RU2805219C1 - Method for protecting truncated parameter, device, computer readable data medium and microchip - Google Patents

Abstract

FIELD: wireless communication.

SUBSTANCE: network mobility control element determines whether a terminal accessing the network meets a predetermined condition, where the predetermined condition includes that the terminal uses a CIoT 5GS control plane optimization function. The mobility control network element sends to the terminal, when the terminal meets a predetermined condition, a downlink NAS message in which NAS security protection is performed using the NAS security context, wherein the downlink NAS message includes a truncated 5G-S-TMSI parameter.

EFFECT: increased security of information transmission.

39 cl, 15 dwg

Description

FIELD OF TECHNOLOGY TO WHICH THE INVENTION RELATES

[0001] The present application relates to the field of communication technology and, in particular, to a method for protecting a truncated parameter and an apparatus.

BACKGROUND OF THE ART

[0002] Currently, in some procedures (for example, in the reestablishment procedure), the terminal sends a radio resource control (RRC) message to the network access device, which carries the temporary identifier of the mobile subscriber of the evolution of the system architecture 5- 5th generation-system architecture evolution-temporary mobile subscriber identity, 5G-S-TMSI, so that the network access device can define a specific access and mobility management function (AMF) based on 5G-S- TMSI.

[0003] However, since the RRC message has a limited length, the RRC message may not carry the full 5G-S-TMSI. In this case, the terminal needs to truncate the 5G-S-TMSI using the truncated parameter and then report the truncated 5G-S-TMSI to the network access device using an RRC message. Upon receiving the truncated parameter (eg, truncated 5G-S-TMSI), the network access device restores the truncated parameter to the full parameter (eg, full 5G-S-TMSI).

[0004] In another similar scenario, the terminal may also need to truncate some other specific parameters and perform a similar operation as described above.

[0005] The truncated parameter used by the terminal is usually configured on the network side. An access stratum (AS) security context is not established between the network access device and the terminal is using the 5th generation system (5GS) optimization function of the cellular internet of things (CIoT) control plane. Therefore, the network access device cannot perform AS security protection on the truncated parameter, and the network access device can only send the truncated parameter without AS security protection to the terminal. In this case, the truncated parameter could be modified by an attacker. When a truncated parameter is modified, the terminal cannot receive the correct truncated parameter. As a result, the terminal cannot access the network.

SUMMARY OF THE INVENTION

[0006] The present application provides a method for protecting a truncated parameter, an apparatus, a computer readable storage medium, and a chip for reducing the security risk of a truncated parameter during transmission.

[0007] In accordance with the first aspect, a method for protecting a truncated parameter is provided, which includes: The mobility control network element determines whether the terminal meets a predetermined condition, wherein the predetermined condition includes that the terminal uses a CIoT 5GS plane optimization function management. The mobility control network element sends to the terminal, when the terminal meets a predetermined condition, a downlink NAS message in which NAS security protection is performed using the NAS security context, where the downlink NAS message includes a truncated parameter, and the truncated parameter is used to truncation of the 5G-S-TMSI terminal.

[0008] Based on the technical solution in the present application, when the terminal meets the preset condition, the terminal is a terminal that uses the CIoT 5GS control plane optimization function. Therefore, the mobility network element sends a downlink NAS message to the terminal in which NAS security protection is performed using the NAS security context, so that the terminal receives a truncated parameter on which NAS security protection is performed. This ensures that the truncated parameter received by the terminal is not replaced or tampered with, thereby avoiding a denial of service attack launched by an attacker against the terminal, and further ensuring that the terminal can normally access the network.

[0009] In an exemplary embodiment, the truncated parameter is previously stored in the network mobility control element. Thus, the network mobility control element does not need to receive the truncated parameter from another device (eg, a network access device), thereby simplifying the procedure.

[0010] In an exemplary embodiment, the method further includes: The network mobility control element receives the truncated parameter sent by the network access device. It can be understood that the network mobility control element receives a truncated parameter from the network access device. Therefore, the mobility network element does not need to pre-configure the truncated parameter, thereby reducing the complexity of configuring the truncated parameter.

[0011] In an exemplary embodiment, the mobility control network element determines whether the terminal meets a predetermined condition includes: The mobility control network element determines whether the terminal uses a control plane CIoT 5GS optimization function. If the terminal uses the CIoT 5GS control plane optimization function, the mobility control network element determines that the terminal meets a predefined condition; or if the terminal does not use the CIoT 5GS control plane optimization function, the mobility control network element determines that the terminal does not meet a predefined condition.

[0012] In an exemplary embodiment, the predetermined condition further includes that the terminal is initially registered with the network. That the mobility control network element determines whether the terminal meets a predetermined condition includes: The mobility control network element determines whether the terminal uses the CIoT 5GS control plane optimization function and whether the terminal is initially registered with the network. If the terminal uses the CIoT 5GS control plane optimization function and the terminal is initially registered with the network, the mobility network element determines that the terminal meets a predefined condition; or if the terminal does not use the CIoT 5GS control plane optimization function or the terminal is not initially registered with the network, the network mobility control element determines that the terminal does not meet a predefined condition.

[0013] In an exemplary embodiment, the mobility control network element determines whether the terminal is initially registered with the network includes: The mobility control network element determines, based on the registration type reported by the terminal, that the terminal is initially registered with the network.

[0014] In an exemplary embodiment, the predetermined condition further includes that the terminal needs to update the truncated parameter. That the mobility control network element determines whether the terminal meets a predetermined condition includes: The mobility control network element determines whether the terminal uses the CIoT 5GS control plane optimization function and whether the terminal needs to update the truncated parameter. If the terminal uses the CIoT 5GS control plane optimization function and the terminal needs to update the truncated parameter, the mobility network element determines that the terminal meets the predefined condition; or if the terminal does not use the CIoT 5GS control plane optimization function or the terminal does not need to update the truncated parameter, the mobility network element determines that the terminal does not meet the predefined condition.

[0015] In an exemplary embodiment, the mobility control network element determining whether the terminal needs to update the truncated parameter includes: When the truncated parameter configured in the mobility control network element is different from the truncated parameter that is stored in the context of the terminal, the network element mobility management determines that the terminal needs to update the truncated parameter.

[0016] In an exemplary embodiment, the mobility network element determining whether the terminal needs to update the truncated parameter includes: After the mobility network element updates the truncated parameter, the mobility network element determines that the terminal needs to update the truncated parameter. In an exemplary embodiment, the mobility control network element determining whether the terminal uses the control plane CIoT 5GS optimization function includes: If the preferred network behavior reported by the terminal indicates that the terminal prefers to use the control plane CIoT 5GS optimization function, and the network element mobility management supports the CIoT 5GS control plane optimization function, the mobility management network element determines that the terminal uses the CIoT 5GS control plane optimization function.

[0017] In an exemplary embodiment, the mobility control network element determines whether the terminal uses the control plane CIoT 5GS optimization function includes: If the terminal context indicates that the terminal uses the control plane CIoT 5GS optimization function, the mobility control network element determines whether that the terminal uses the CIoT 5GS control plane optimization function.

[0018] In an exemplary embodiment, the mobility network element determining whether the terminal meets a predetermined condition includes: After the mobility network element receives the registration request message or the service request message of the terminal, the mobility network element determines whether whether the terminal meets a predefined condition.

[0019] In an exemplary embodiment, the downlink NAS message is a service acceptance message or a registration acceptance message.

[0020] Optionally, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[0021] In an exemplary embodiment, the method further includes: The mobility management network element updates the truncated parameter based on the number of AMF set IDs and/or the number of AMF pointers. Alternatively, the network mobility control element updates the truncated parameter in accordance with the instructions of the network management system. Alternatively, the network mobility control element receives the updated truncated parameter sent by the network access device.

[0022] According to a second aspect, a method for protecting a truncated parameter is provided, which includes: The terminal receives a downlink NAS message that is sent by a mobility management network element, and wherein NAS security protection is performed using a NAS security context, wherein the downlink NAS message includes a truncated parameter, and the truncated parameter is used to truncate the 5G-S-TMSI of the terminal. The terminal performs security deprotection on the downlink NAS message. The terminal stores the truncated parameter after successfully deprotecting the downlink NAS message.

[0023] Based on the technical solution in the present application, since the truncated parameter is carried in a downlink NAS message for which NAS security protection is performed, the truncated parameter is also under NAS security protection. This ensures that the truncated parameter is not replaced or tampered with, thereby avoiding a denial of service attack launched by an attacker against the terminal, and further ensuring that the terminal can normally access the network.

[0024] In an exemplary embodiment, the terminal storing the truncated parameter includes: The NAS layer of the terminal storing the truncated parameter.

[0025] In an exemplary embodiment, the method further includes: The NAS layer of the terminal sending the truncated parameter to the RRC layer of the terminal. The terminal's RRC layer truncates the terminal's 5G-S-TMSI based on the truncated parameter to obtain a truncated 5G-S-TMSI.

[0026] In an exemplary embodiment, the method further includes: The terminal's NAS layer truncates the terminal's 5G-S-TMSI based on the truncated parameter to obtain a truncated 5G-S-TMSI. The NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[0027] In an exemplary embodiment, the terminal storing the truncated parameter includes: The terminal's NAS layer sends the truncated parameter to the terminal's RRC layer. The terminal RRC layer stores the truncated parameter.

[0028] In an exemplary embodiment, the method further includes: The terminal's RRC layer truncates the terminal's 5G-S-TMSI based on the truncated parameter to obtain a truncated 5G-S-TMSI.

[0029] In an exemplary embodiment, the method further includes: The RRC layer of the terminal sending the truncated parameter to the NAS layer of the terminal. The terminal NAS layer truncates the terminal's 5G-S-TMSI based on the truncated parameter to obtain a truncated 5G-S-TMSI. The NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[0030] In an exemplary embodiment, the method further includes: The terminal sends an RRC re-establishment request message to the network access device, where the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[0031] In an exemplary embodiment, the downlink NAS message is a service acceptance message or a registration acceptance message.

[0032] Optionally, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[0033] According to a third aspect, a method for protecting a truncated parameter is provided, which includes: The network access device determines whether the terminal supports a CIoT 5GS optimization function. The network access device sends the truncated parameter to the network mobility control element when the terminal supports the 5GS CIoT optimization function, where the truncated parameter is used to truncate the terminal's 5G-S-TMSI.

[0034] Based on the technical solution in the present application, the network access device sends the truncated parameter to the network mobility control element when the terminal supports the CIoT 5GS optimization function, so that the network mobility control element performs NAS security protection with respect to the truncated parameter. This prevents the network access device from directly sending the truncated parameter without security protection to the terminal, and reduces the security risk of the truncated parameter during transmission.

[0035] In an exemplary embodiment, the network access device determining whether the terminal supports the CIoT 5GS optimization function includes: If the terminal capability indication information is used to indicate that the terminal supports the CIoT 5GS optimization function, the network access device determines that the terminal supports the CIoT 5GS optimization function.

[0036] In an exemplary embodiment, the network access device determining whether the terminal supports the CIoT 5GS optimization function includes: If the frequency used by the terminal is the same as the frequency used by the CIoT device, the network access device determines that the terminal supports CIoT 5GS optimization function.

[0037] In an exemplary embodiment, the network access device determining whether the terminal supports the CIoT 5GS optimization function includes: If the message type sent by the terminal matches the message type sent by the CIoT device, the network access device determines that The terminal supports the CIoT 5GS optimization function.

[0038] In an exemplary embodiment, the network access device determining whether the terminal supports the CIoT 5GS optimization function includes: After the network access device receives the uplink RRC message sent by the terminal, the network access device determines whether the terminal supports the CIoT 5GS optimization function.

[0039] In an exemplary embodiment, the uplink RRC message is an RRC Establishment Request message or an RRC Establishment Complete message.

[0040] In an exemplary embodiment, the network access device sending the truncated parameter to the network mobility control element includes: The network access device sending a UE initial message to the network mobility control element, where the UE initial message includes the truncated parameter.

[0041] In a possible embodiment, the truncated parameter is previously stored in the network access device.

[0042] In an exemplary embodiment, the method further includes: The network access device receives an RRC re-establishment request message sent by the terminal, where the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[0043] Optionally, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[0044] In accordance with a fourth aspect, a method for protecting a truncated parameter is provided, which includes: The mobility network element updates the truncated parameter, wherein the truncated parameter is used to truncate the 5G-S-TMSI. The mobility control network element looks for a terminal that uses the CIoT 5GS control plane optimization feature. The mobility control network element sends to a terminal that uses the control plane CIoT 5GS optimization function a downlink NAS message in which NAS security protection is performed using the NAS security context, wherein the downlink NAS message includes the updated truncated parameter.

[0045] Based on the technical solution in the present application, in a scenario in which the mobility network element updates a truncated parameter, the mobility network element sends to the terminal that uses the control plane CIoT 5GS optimization function a downlink NAS message in which the security protection NAS runs using the NAS security context. Because the updated truncated parameter is sent in the downlink NAS message, the updated truncated parameter is not replaced or tampered with by an attacker during transmission over the air interface. In this way, the terminal that uses the CIoT 5GS control plane optimization function can obtain the correct updated truncated parameter in a timely manner to ensure that the terminal that uses the CIoT 5GS control plane optimization function can access the network normally.

[0046] In an exemplary embodiment, the mobility network element updating the truncated parameter includes: The mobility network element updates the truncated parameter based on the number of AMF set IDs and/or the number of AMF pointers. Alternatively, the network mobility control element updates the truncated parameter in accordance with the instructions of the network management system. Alternatively, the network mobility control element receives the updated truncated parameter sent by the network access device.

[0047] In an exemplary embodiment, the mobility management network element sends to a terminal that uses the control plane CIoT 5GS optimization function, a downlink NAS message in which NAS security protection is performed using the NAS security context, including: When the terminal, which uses the CIoT 5GS control plane optimization function is in the connected state, the mobility network element sends a downlink NAS message to the terminal that uses the CIoT 5GS control plane optimization function.

[0048] In an exemplary embodiment, the mobility management network element sends to a terminal that uses the control plane CIoT 5GS optimization function, a downlink NAS message in which NAS security protection is performed using the NAS security context, including: When the terminal, which uses the CIoT 5GS control plane optimization function is in an unconnected state, the mobility network element waits for the terminal that uses the CIoT 5GS control plane optimization function to enter the connected state. After the terminal that uses the CIoT 5GS optimization function of the control plane enters the connected state, and the mobility network element and the terminal that uses the CIoT 5GS optimization function of the control plane activate NAS security, the mobility network element sends a downlink NAS message communication terminal that uses the CIoT 5GS control plane optimization function.

[0049] In an exemplary embodiment, the mobility management network element sends to a terminal that uses the control plane CIoT 5GS optimization function, a downlink NAS message in which NAS security protection is performed using the NAS security context, including: When the terminal, which uses the CIoT 5GS control plane optimization function is in an unconnected state, the mobility network element causes, through a paging, the terminal that uses the CIoT 5GS control plane optimization function to transition to the connected state. After the terminal that uses the CIoT 5GS optimization function of the control plane enters the connected state, and the mobility network element and the terminal that uses the CIoT 5GS optimization function of the control plane activate NAS security, the mobility network element sends a downlink NAS message communication terminal that uses the CIoT 5GS control plane optimization function.

[0050] In an exemplary embodiment, the downlink NAS message is a UE configuration update command message or a service acceptance message.

[0051] Optionally, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[0052] According to a fifth aspect, a method for protecting a truncated parameter is provided, which includes: A network mobility control element receives a truncated parameter sent by a network access device, where the truncated parameter is used to truncate a 5G-S-TMSI of a terminal. The mobility network element performs 5G-S-TMSI integrity calculation of the terminal based on the terminal's NAS security context to generate the first NAS MAC. The mobility network element sends the first NAS MAC to the network access device.

[0053] Based on the technical solution in the present application, the network mobility control element performs truncated parameter integrity calculation to obtain the first NAS MAC, and sends the first NAS MAC to the network access device. Thus, the network access device can send the first NAS MAC and the truncated parameter to the terminal to ensure that the truncated parameter is not replaced or tampered with by an attacker during transmission, thereby reducing the security risk of the truncated parameter during transmission.

[0054] In an exemplary embodiment, the method further includes: The network mobility control element receives security indication information and/or a relevance parameter sent by the network access device, where the security indication information is used to direct the network mobility control element to perform security protection with respect to the truncated parameter. , and the relevance parameter is used to calculate the integrity of the truncated parameter.

[0055] Optionally, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[0056] According to a sixth aspect, a method for protecting a truncated parameter is provided, which includes: A network access device sends the truncated parameter to a network mobility control element, where the truncated parameter is used to truncate a 5G-S-TMSI of a terminal. The network access device receives the first NAS MAC sent by the network mobility control element, where the first NAS MAC is obtained by performing a truncated parameter integrity calculation. The network access device sends the first NAS MAC and the truncated parameter to the terminal.

[0057] Based on the technical solution in the present application, the network access device can send the first NAS MAC and the truncated parameter to the terminal to ensure that the truncated parameter is not replaced or tampered with by an attacker during transmission, thereby reducing the security risk of the truncated parameter in the process transfers.

[0058] In an exemplary embodiment, the method further includes: The network access device determines whether the terminal supports the CIoT 5GS optimization function. That the network access device sends a truncated parameter to the network mobility control element includes: The network access device sends a truncated parameter to the network mobility control element when the terminal supports the CIoT 5GS optimization function.

[0059] In an exemplary embodiment, the network access device determining whether the terminal supports the CIoT 5GS optimization function includes: If the terminal capability indication information is used to indicate that the terminal supports the CIoT 5GS optimization function, the network access device determines that the terminal supports the CIoT 5GS optimization function.

[0060] In an exemplary embodiment, the network access device determining whether the terminal supports the CIoT 5GS optimization function includes: If the frequency used by the terminal is the same as the frequency used by the CIoT device, the network access device determines that the terminal supports CIoT 5GS optimization function.

[0061] In an exemplary embodiment, the network access device determining whether the terminal supports the CIoT 5GS optimization function includes: If the message type sent by the terminal matches the message type sent by the CIoT device, the network access device determines that The terminal supports the CIoT 5GS optimization function.

[0062] In an exemplary embodiment, the network access device determining whether the terminal supports the CIoT 5GS optimization function includes: After the network access device receives the uplink RRC message sent by the terminal, the network access device determines whether the terminal supports the CIoT 5GS optimization function.

[0063] In an exemplary embodiment, the uplink RRC message is an RRC Establishment Request message or an RRC Establishment Complete message.

[0064] In an exemplary embodiment, the method further includes: The network access device sends security indication information and/or a relevance parameter to a network mobility control element, where the security indication information is used to direct the network mobility control element to perform security protection with respect to the truncated parameter, and the relevance parameter is used to calculate the integrity of the truncated parameter.

[0065] In an exemplary embodiment, the method further includes: The network access device receives an RRC re-establishment request message sent by the terminal, where the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[0066] Optionally, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[0067] According to the seventh aspect, a method for protecting a truncated parameter is provided, which includes: A terminal receives a first NAS MAC and a truncated parameter sent by a network access device, where the truncated parameter is used to truncate a 5G-S-TMSI of the terminal. The terminal performs a truncated parameter integrity calculation based on the NAS security context to form a second NAS MAC. The terminal checks the first NAS MAC based on the second NAS MAC. The terminal saves the truncated parameter if the verification of the first NAS MAC is successful.

[0068] Based on the technical solution in the present application, since the terminal receives the first NAS MAC and the truncated parameter, the terminal can verify the integrity of the truncated parameter by checking the first NAS MAC. When determining that the truncated parameter has not been replaced or tampered with, the terminal stores the truncated parameter to truncate the 5G-S-TMSI based on the truncated parameter in a subsequent process.

[0069] In an exemplary embodiment, the terminal storing the truncated parameter includes: The RRC layer of the terminal storing the truncated parameter.

[0070] In an exemplary embodiment, the method further includes: The terminal's RRC layer truncates the terminal's 5G-S-TMSI based on the truncated parameter to obtain a truncated 5G-S-TMSI.

[0071] In an exemplary embodiment, the method further includes: The RRC layer of the terminal sending the truncated parameter to the NAS layer of the terminal. The terminal NAS layer truncates the terminal's 5G-S-TMSI based on the truncated parameter to obtain a truncated 5G-S-TMSI. The NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[0072] In an exemplary embodiment, the terminal storing the truncated parameter includes: The RRC layer of the terminal sends the truncated parameter to the NAS layer of the terminal. The terminal NAS layer stores the truncated parameter.

[0073] In an exemplary embodiment, the method further includes: The terminal's NAS layer truncates the terminal's 5G-S-TMSI based on the truncated parameter to obtain a truncated 5G-S-TMSI. The NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[0074] In an exemplary embodiment, the method further includes: The NAS layer of the terminal sending the truncated parameter to the RRC layer of the terminal. The terminal's RRC layer truncates the terminal's 5G-S-TMSI based on the truncated parameter to obtain a truncated 5G-S-TMSI.

[0075] In an exemplary embodiment, the method further includes: The terminal sends an RRC re-establishment request message to the network access device, where the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[0076] Optionally, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[0077] According to the eighth aspect, a communication device is provided that includes: a processing module configured to determine whether a terminal meets a predetermined condition, where the predetermined condition includes that the terminal uses a CIoT 5GS plane optimization function management; and a communication module configured to send to the terminal, when the terminal meets a predetermined condition, a downlink NAS message in which NAS security protection is performed using a NAS security context, wherein the downlink NAS message includes a truncated parameter, and the truncated parameter used to truncate the 5G-S-TMSI of the terminal.

[0078] In an exemplary embodiment, the communication device further includes a storage module; and the storage module is configured to store the truncated parameter.

[0079] In an exemplary embodiment, the communication module is further configured to receive a truncated parameter sent by the network access device.

[0080] In an exemplary embodiment, the processing module is configured to determine whether the terminal meets a predetermined condition includes: determining whether the terminal uses a CIoT 5GS control plane optimization function; and if the terminal uses a CIoT 5GS optimization function of the control plane, determining that the terminal meets a predetermined condition; or if the terminal does not use the CIoT 5GS control plane optimization function, determining that the terminal does not meet a predefined condition.

[0081] In an exemplary embodiment, the predetermined condition further includes that the terminal is initially registered with the network. That the processing module is configured to determine whether the terminal meets a predetermined condition includes: determining whether the terminal uses the CIoT 5GS control plane optimization function and whether the terminal was initially registered in the network; and if the terminal uses a CIoT 5GS optimization function of the control plane and the terminal is initially registered in the network, determining that the terminal meets a predetermined condition; or if the terminal does not use the CIoT 5GS control plane optimization function or the terminal is not initially registered with the network, determining that the terminal does not meet a predefined condition.

[0082] In an exemplary embodiment, the processing module is particularly configured to determine, based on the registration type reported by the terminal, that the terminal is initially registered with the network.

[0083] In an exemplary embodiment, the predetermined condition further includes that the terminal needs to update the truncated parameter. That the processing module is configured to determine whether the terminal meets a predetermined condition includes: determining whether the terminal uses the CIoT 5GS control plane optimization function and whether the terminal needs to update the truncated parameter; and if the terminal uses a CIoT 5GS optimization function of the control plane and the terminal needs to update the truncated parameter, determining that the terminal meets a predetermined condition; or if the terminal does not use the CIoT 5GS control plane optimization function or the terminal does not need to update the truncated parameter, determining that the terminal does not meet a predefined condition.

[0084] In an exemplary embodiment, the processing module is specifically configured to: when a truncated parameter configured in the mobility network element differs from a truncated parameter that is stored in the context of the terminal, determine that the terminal needs to update the truncated parameter.

[0085] In an exemplary embodiment, the processing module is particularly configured to: after the mobility network element updates the truncated parameter, determine that the terminal needs to update the truncated parameter.

[0086] In an exemplary embodiment, the processing module is further configured to update the truncated parameter based on the number of AMF set IDs and/or the number of AMF pointers; or updating the truncated parameter in accordance with the instructions of the network management system; or receiving an updated truncated parameter sent by the network access device.

[0087] In a possible embodiment, the processing module is particularly configured to: if the preferred network behavior reported by the terminal indicates that the terminal prefers to use the CIoT 5GS control plane optimization function, and the mobility control network element supports the CIoT 5GS plane optimization function control, determining that the terminal is using the CIoT 5GS control plane optimization function.

[0088] In an exemplary embodiment, the processing module is particularly configured to: if the terminal context indicates that the terminal is using a CIoT 5GS control plane optimization function, determining that the terminal is using a CIoT 5GS control plane optimization function.

[0089] In an exemplary embodiment, the processing module is particularly configured to: after the communication module receives a registration request message or a service request message from a terminal, determine whether the terminal meets a predetermined condition.

[0090] In an exemplary embodiment, the downlink NAS message is a service acceptance message or a registration acceptance message.

[0091] Optionally, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[0092] In an exemplary embodiment, the processing module is configured to update the truncated parameter based on the number of AMF set IDs and/or the number of AMF pointers.

[0093] In an exemplary embodiment, the processing module is configured to update the truncated parameter in accordance with an instruction of the network management system.

[0094] In an exemplary embodiment, the communication module is further configured to receive an updated truncated parameter sent by the network access device.

[0095] According to a ninth aspect, a communication apparatus is provided that includes: a communication module configured to receive a downlink NAS message that is sent by a mobility management network element and on which NAS security protection is performed using a NAS security context, where the downlink NAS message includes a truncated parameter, and the truncated parameter is used to truncate the 5G-S-TMSI of the terminal; a processing module configured to perform security deprotection on the downlink NAS message; and a storage module configured to store the truncated parameter after the processing module successfully performs security deprotection on the downlink NAS message.

[0096] In an exemplary embodiment, the storage module is configured to store the truncated parameter, including: storing by the NAS layer the truncated parameter.

[0097] In an exemplary embodiment, the processing module is further configured to receive a truncated 5G-S-TMSI, including: sending, through the NAS layer, the truncated parameter to the RRC layer; and truncating by the RRC layer of the 5G-S-TMSI of the terminal based on the truncated parameter to obtain the truncated 5G-S-TMSI.

[0098] In an exemplary embodiment, the processing module is further configured to obtain a truncated 5G-S-TMSI, including: trimming by a NAS layer of a 5G-S-TMSI terminal based on the truncated parameter to obtain a truncated 5G-S-TMSI; and sending, via the NAS layer, the truncated 5G-S-TMSI to the RRC layer.

[0099] In an exemplary embodiment, the storage module is configured to store the truncated parameter, including: sending, through the NAS layer, the truncated parameter to the RRC layer; and storing, by the RRC layer, the truncated parameter.

[00100] In an exemplary embodiment, the processing module is further configured to obtain a truncated 5G-S-TMSI, including: truncation by an RRC layer of a 5G-S-TMSI terminal based on the truncated parameter to obtain a truncated 5G-S-TMSI.

[00101] In an exemplary embodiment, the processing module is further configured to receive a truncated 5G-S-TMSI, including: sending, via the RRC layer, the truncated parameter to the NAS layer; truncating by the terminal's 5G-S-TMSI NAS layer based on the truncated parameter to obtain a truncated 5G-S-TMSI; and sending, via the NAS layer, the truncated 5G-S-TMSI to the RRC layer.

[00102] In an exemplary embodiment, the downlink NAS message is a service acceptance message or a registration acceptance message.

[00103] In an exemplary design, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[00104] In an exemplary embodiment, the communication module is further configured to send an RRC re-establishment request message to the network access device, where the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[00105] According to a tenth aspect, a communication device is provided that includes: a processing module configured to determine whether a terminal supports a CIoT 5GS optimization function; and a communication module configured to: send the truncated parameter to the mobility network element when the terminal supports a 5GS CIoT optimization function, where the truncated parameter is used to truncate the terminal's 5G-S-TMSI.

[00106] In an exemplary embodiment, the processing module is particularly configured to: if the terminal capability indication information is used to indicate that the terminal supports the CIoT 5GS optimization function, determine that the terminal supports the CIoT 5GS optimization function.

[00107] In an exemplary embodiment, the processing module is particularly configured to: if the frequency used by the terminal matches the frequency used by the CIoT device, determine that the terminal supports the CIoT 5GS optimization function.

[00108] In an exemplary embodiment, the processing module is particularly configured to: if the type of message sent by the terminal matches the type of message sent by the CIoT device, determine that the terminal supports the CIoT 5GS optimization function.

[00109] In an exemplary embodiment, the processing module is particularly configured to: after the communication module receives an uplink RRC message sent by the terminal, determine whether the terminal supports the CIoT 5GS optimization function.

[00110] In an exemplary embodiment, the uplink RRC message is an RRC Establishment Request message or an RRC Establishment Complete message.

[00111] In an exemplary embodiment, the communication module is specifically configured to send a UE initial message to a network mobility control element, where the UE initial message includes a truncated parameter.

[00112] In an exemplary embodiment, the communication device further includes a storage module; and the storage module is configured to store the truncated parameter.

[00113] In an exemplary embodiment, the communication module is configured to receive an RRC re-establishment request message sent by the terminal, where the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[00114] Optionally, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[00115] In accordance with the eleventh aspect, a communication device is provided that includes: a processing module configured to: update a truncated parameter, where the truncated parameter is used to truncate a 5G-S-TMSI; and searching for a terminal that uses the CIoT 5GS control plane optimization function; and a communication module configured to send to a terminal that uses the CIoT 5GS control plane optimization function a downlink NAS message, in which NAS security protection is performed using a NAS security context, wherein the downlink NAS message includes the updated truncated parameter .

[00116] In an exemplary embodiment, the processing module is configured to update the truncated parameter based on the number of AMF set IDs and/or the number of AMF pointers; or updating the truncated parameter in accordance with the instructions of the network management system; or receiving an updated truncated parameter sent by the network access device.

[00117] In an exemplary embodiment, the communication module is particularly configured to: when a terminal that uses the CIoT 5GS control plane optimization function is in a connected state, send a downlink NAS message to the terminal that uses the CIoT 5GS control plane optimization function.

[00118] In an exemplary embodiment, the communication module is particularly configured to: when a terminal that uses a CIoT 5GS control plane optimization function is in an unconnected state, wait until the terminal that uses a CIoT 5GS control plane optimization function transitions to a connected state state; and after the terminal that uses the CIoT 5GS control plane optimization function enters the connected state, and the mobility network element and the terminal that uses the CIoT 5GS control plane optimization function activate NAS security, sending a downlink NAS message to the terminal, which uses the CIoT 5GS control plane optimization feature.

[00119] In an exemplary embodiment, the communication module is particularly configured to: when a terminal that uses a CIoT 5GS control plane optimization function is in an unconnected state, instruct, by paging, the terminal that uses a CIoT 5GS control plane optimization function to go to connected state; and after the terminal that uses the CIoT 5GS optimization function of the control plane enters the connected state, and the mobility network element and the terminal that uses the CIoT 5GS optimization function of the control plane activate NAS security, sending a downlink NAS message to the terminal, which uses the CIoT 5GS control plane optimization feature.

[00120] In an exemplary embodiment, the downlink NAS message is a UE configuration update command message or a service acceptance message.

[00121] In an exemplary embodiment, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI.

[00122] The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[00123] In accordance with the twelfth aspect, a communication device is provided that includes: a communication module configured to receive a truncated parameter sent by a network access device, where the truncated parameter is used to truncate a 5G-S-TMSI terminal; and a processing module configured to perform a 5G-S-TMSI integrity calculation of the terminal based on the terminal's NAS security context to generate a first NAS MAC, where the communication module is further configured to send the first NAS MAC to the network access device.

[00124] In an exemplary embodiment, the communication module is further configured to receive security indication information and/or a relevance parameter sent by the network access device, where the security indication information is used to instruct the network mobility control element to perform security protection with respect to the truncated parameter and the relevance parameter used to calculate the integrity of the truncated parameter.

[00125] In an exemplary embodiment, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[00126] In accordance with the thirteenth aspect, a communication device is provided that includes: a communication module configured to: send a truncated parameter to a network mobility control element, where the truncated parameter is used to truncate a 5G-S-TMSI terminal; receiving a first NAS MAC sent by the mobility management network element, where the first NAS MAC is obtained by performing an integrity calculation of the truncated parameter; and sending the first NAS MAC and the truncated parameter to the terminal.

[00127] In an exemplary embodiment, the communication device further includes a processing module; the processing module is configured to determine whether the terminal supports the CIoT 5GS optimization function; and the communication module is particularly configured to send the truncated parameter to the mobility network element when the terminal supports the CIoT 5GS optimization function.

[00128] In an exemplary embodiment, the processing module is particularly configured to: if the terminal capability indication information is used to indicate that the terminal supports the CIoT 5GS optimization function, determine that the terminal supports the CIoT 5GS optimization function.

[00129] In an exemplary embodiment, the processing module is particularly configured to: if the frequency used by the terminal matches the frequency used by the CIoT device, determine that the terminal supports the CIoT 5GS optimization function.

[00130] In an exemplary embodiment, the processing module is particularly configured to: if the type of message sent by the terminal matches the type of message sent by the CIoT device, determine that the terminal supports the CIoT 5GS optimization function.

[00131] In an exemplary embodiment, the communication module is further configured to receive an uplink RRC message sent by the terminal; and the processing module is particularly configured to: after the communication module receives the uplink RRC message sent by the terminal, determine whether the terminal supports the CIoT 5GS optimization function.

[00132] In an exemplary embodiment, the uplink RRC message is an RRC Establishment Request message or an RRC Establishment Complete message.

[00133] In an exemplary embodiment, the communication module is further configured to send security indication information and/or a relevance parameter to the mobility network element, where the security indication information is used to instruct the mobility network element to perform security protection with respect to the truncated parameter and the relevance parameter is used to calculating the integrity of the truncated parameter.

[00134] In an exemplary embodiment, the communication module is further configured to receive an RRC re-establishment request message sent by the terminal, where the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[00135] In an exemplary embodiment, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[00136] In accordance with the fourteenth aspect, a communication device is provided that includes: a communication module configured to receive a first NAS MAC and a truncated parameter that are sent by a network access device, where the truncated parameter is used to truncate a 5G-S-TMSI terminal ; a processing module configured to: perform an integrity calculation of the truncated parameter based on the NAS security context to generate a second NAS MAC; and checking the first NAS MAC based on the second NAS MAC; and a storage module configured to store the truncated parameter if the verification of the first NAS MAC is successful.

[00137] In an exemplary embodiment, the storage module is configured to store the truncated parameter, including: storing by the RRC layer the truncated parameter.

[00138] In an exemplary embodiment, the processing module is further configured to obtain the truncated 5G-S-TMSI, including: truncating by the RRC layer of the 5G-S-TMSI terminal based on the truncated parameter to obtain the truncated 5G-S-TMSI.

[00139] In an exemplary embodiment, the processing module is further configured to receive the truncated 5G-S-TMSI, including: sending, via the RRC layer, the truncated parameter to the NAS layer; truncating by the terminal's 5G-S-TMSI NAS layer based on the truncated parameter to obtain a truncated 5G-S-TMSI; and sending, via the NAS layer, the truncated 5G-S-TMSI to the RRC layer.

[00140] In an exemplary embodiment, the storage module is configured to store the truncated parameter, including: sending, via the RRC layer, the truncated parameter to the NAS layer; and storing, by the NAS layer, the truncated parameter.

[00141] In an exemplary embodiment, the processing module is further configured to obtain a truncated 5G-S-TMSI, including: truncating by the terminal's 5G-S-TMSI NAS layer based on the truncated parameter to obtain a truncated 5G-S-TMSI; and sending, via the NAS layer, the truncated 5G-S-TMSI to the RRC layer.

[00142] In an exemplary embodiment, the processing module is further configured to receive the truncated 5G-S-TMSI, including: sending, by the NAS layer, the truncated parameter to the RRC layer; and truncating by the RRC layer of the 5G-S-TMSI of the terminal based on the truncated parameter to obtain the truncated 5G-S-TMSI.

[00143] In an exemplary embodiment, the communication module is further configured to send an RRC re-establishment request message to the network access device, where the RRC re-establishment request message includes a truncated 5G-S-TMSI.

[00144] In an exemplary embodiment, bits one through ten in 5G-S-TMSI are used to indicate the AMF Set ID, bits eleven through sixteen in 5G-S-TMSI are used to indicate the AMF Indicator, and bits seventeen through forty-eight in 5G -S-TMSI are used to indicate 5G-TMSI. The truncated parameter includes a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI indicator.

[00145] In accordance with the fifteenth aspect, a communication device is provided that includes a processor and a communication interface. The processor is configured to execute a computer program instruction such that the communication device implements a method for protecting a truncated parameter according to any embodiment provided in any of the first to seventh aspects.

[00146] According to a sixteenth aspect, a computer-readable storage medium is provided. The computer-readable medium stores the instruction, and when the instruction is executed on the computer, the computer is able to implement the truncated parameter protecting method according to any embodiment provided in any of the first to seventh aspects.

[00147] According to a seventeenth aspect, a computer program product is provided. The computer program product includes instructions, and when the computer program product is executed on a computer, the computer is enabled to implement a truncated parameter protecting method according to any embodiment provided in any of the first to seventh aspects.

[00148] According to the eighteenth aspect, a chip is provided. The chip includes a processor, and when the processor executes a computer program instruction, the chip is able to implement a truncated parameter protection method according to any embodiment of the first aspect to the seventh aspect.

[00149] According to a nineteenth aspect, a communication system is provided. The communication system includes a network mobility control element and a network access device. The mobility management network element is configured to implement the truncated parameter protecting method in any embodiment of the first aspect. The network access device is configured to implement the truncated parameter protection method in any embodiment of the third aspect.

[00150] In accordance with the twentieth aspect, a communication system is provided. The communication system includes a network mobility control element and a network access device. The mobility management network element is configured to implement a truncated parameter protecting method according to any embodiment of the fifth aspect. The network access device is configured to implement the truncated parameter protection method according to any embodiment of the sixth aspect.

BRIEF DESCRIPTION OF THE DRAWINGS

[00151] FIG. 1 is a schematic diagram of the encryption/decryption process;

[00152] FIG. 2 is a schematic diagram of MAC calculation by a transmitter;

[00153] FIG. 3 is a schematic diagram of MAC calculation by a receiver;

[00154] FIG. 4 is a schematic diagram of a procedure for configuring truncated parameters according to known technology;

[00155] FIG. 5 is a schematic structure diagram of a 5G network according to an embodiment of the present application;

[00156] FIG. 6 is a schematic diagram of a protocol stack according to an embodiment of the present application;

[00157] FIG. Fig. 7 is a schematic structure diagram of an apparatus according to an embodiment of the present application;

[00158] FIG. 8 is a flowchart of a method for protecting a truncated parameter according to an embodiment of the present application;

[00159] FIG. 9 is another flowchart of a method for protecting a truncated parameter according to an embodiment of the present application;

[00160] FIG. 10 is another flowchart of a method for protecting a truncated parameter according to an embodiment of the present application;

[00161] FIG. 11 is another flowchart of a method for protecting a truncated parameter according to an embodiment of the present application;

[00162] FIG. 12 is another flowchart of a method for protecting a truncated parameter according to an embodiment of the present application;

[00163] FIG. Fig. 13 is a schematic structure diagram of a terminal according to an embodiment of the present application;

[00164] FIG. Fig. 14 is a schematic block diagram of a network access device according to an embodiment of the present application; And

[00165] FIG. 15 is a schematic structure diagram of a mobility management network element according to an embodiment of the present application.

Description of Embodiments

[00166] In the specification of this application, unless otherwise indicated, "/" means "or". For example, A/B may represent A or B. The term “and/or” as used herein describes only an association relationship for associated objects and means that three relationships may exist. For example, A and/or B may represent the following three cases: Only A exists, both A and B exist, and only B exists. Additionally, “at least one” means one or more, and “many” means two or more. Words such as “first” and “second” do not limit the number and sequence of execution, and words such as “first” and “second” do not indicate a specific difference.

[00167] It should be noted that in this application words such as “example” or “for example” are used to provide an example, illustration or description. Any embodiment or design that is described as an “example” or “for example” in this application should not be interpreted as being preferable or having greater advantages than another embodiment or design. In particular, the use of words such as "example" or "for example" is intended to represent a related concept in a particular way.

[00168] In the descriptions of this application, "indication" may include explicit indication and indirect indication, or may include explicit indication and implicit indication. The information indicated by the information part (the first indication information described below) is referred to as the information to be indicated. In a given implementation process, there are many ways to indicate the information to be specified. For example, the information to be specified may be indicated directly, where the information to be specified, the index of the information to be specified, etc. are indicated. In another example, information to be indicated may be indirectly indicated by indicating other information, and an association relationship exists between the other information and the information to be indicated. In another example, only part of the information to be specified may be specified, and another part of the information to be specified is already known or previously agreed upon. In addition, specific information may also be indicated using a pre-agreed (eg, protocol-defined) order of placement of various pieces of information to reduce the indication overhead to some extent.

[00169] To facilitate understanding of the technical solutions of the present application, the following first briefly describes the terms used in the present application.

[00170] 1. Encryption/Decryption

[00171] Encryption/decryption protects the confidentiality of data during transmission. (Therefore, encryption/decryption can also be called privacy protection.) Privacy means that the actual content cannot be viewed directly. Encryption protection can be implemented by encrypting data using a key and an encryption algorithm. For the specific encryption protection method, see the corresponding descriptions in section 8.2 in 3GPP TS 33.401 f50 or section 6.4.4 in 33.501 f50. The details are not repeated here.

[00172] For example, as shown in FIG. 1, the encryption process at the transmitting side can be as follows: The transmitting side can input parameters such as count, length, bearer and direction into the NEA to determine the keystream. The sending side then determines the ciphertext based on the keystream and the plaintext.

[00173] For example, as shown in FIG. 1, the decryption process at the receiving side may be as follows: The receiving side may input parameters such as number, length, carrier and direction into the NEA to determine the key stream. The receiving party then determines the plaintext based on the key stream and the ciphertext.

[00174] 2. Security/Integrity Check

[00175] Security/integrity checking is used to determine whether the content of a message changes during transmission and can also be used for identity authentication to determine the origin of the message. A message authentication code (MAC) is required to verify integrity and security. For a specific method of verifying integrity and security, see the relevant descriptions in section 8.1 of the 3rd generation partnership project (3GPP) TS 33.401 f50 or section 6.4.3 of 33.501 f50. The details are not repeated here.

[00176] The MAC can be used to check whether the content of a message changes during transmission. Additionally, MAC can be used for identity authentication to determine the origin of a message.

[00177] As shown in FIG. 2, the transmitting side inputs parameters such as key, count, length, bearer, message and direction into the advanced packet system. integrity algorithm (evolved packet system integrity algorithm, EIA), to obtain message authentication code integrity (MAC-I) or NAS-MAC.

[00178] As shown in FIG. 3, the receiving side inputs parameters such as integrity key, number, length, bearer, message and direction into EIA to obtain the excluded message authentication code integrity (XMAC-I) or expected message authentication code integrity (XMAC-I). level without access (excepted non-access stratum message authentication code, XNAS-MAC).

[00179] The receiving party may compare the received MAC-I with the XMAC-I generated by the receiving party to check whether the message is complete. If the MAC-I matches the XMAC-I, the receiving side determines that verification of the received MAC-I is successful, and the receiving side can determine that the message sent by the sending side is complete. If the MAC-I is different from XMAC-I, the receiving end may determine that verification of the received MAC-I failed, and the receiving end may determine that the message sent by the sending end is incomplete.

[00180] 3. Security Context

[00181] Security context refers to information that can be used to implement security protection (eg, encryption/decryption and/or protection/integrity verification) of data.

[00182] The security context may include one or more of the following elements: a root key, an encryption key, an integrity key, a specific parameter (eg, NAS counter), a key set identifier (KSI), security parameters. algorithm, security indicator (for example, an indicator indicating whether encryption is enabled, an indicator indicating whether integrity protection is enabled, an indicator indicating the key expiration date or key length), etc.

[00183] The encryption key is a parameter input by the transmitting party when the transmitting party encrypts the plaintext based on an encryption algorithm to generate the ciphertext. If a symmetric encryption method is used, the encryption key and decryption key are the same. The receiving party can decrypt the ciphertext based on the same encryption algorithm and encryption key. In other words, the sending side and the receiving side can perform encryption and decryption based on the same key.

[00184] The integrity protection key is a parameter input by the sending party when the sending party performs integrity protection of the plaintext or ciphertext based on the integrity protection algorithm. The receiving party can perform, based on the same integrity protection algorithm and integrity protection key, the integrity check of the data for which integrity protection is performed.

[00185] The specific parameter (eg, NAS counter) is a parameter input by the sending side when the sending side performs plaintext or ciphertext replay protection based on the replay protection algorithm. The receiving party may perform, based on the same anti-replay algorithm, a check against reuse of the data that is being protected against replay.

[00186] A security algorithm is used to protect the security of data, such as an encryption algorithm, a decryption algorithm, and an integrity protection algorithm.

[00187] In embodiments of the present application, the security context may include a NAS security context and an AS security context. It can be understood that the NAS security context is used to protect information transmitted between the terminal and the core network. The AS security context is used to protect information transmitted between the terminal and the base station.

[00188] 4. Activate NAS security

[00189] Activating NAS security includes activating NAS integrity protection and activating NAS encryption protection.

[00190] Activating NAS Integrity Protection: After activating NAS integrity protection, it is necessary to use the NAS integrity key and NAS integrity protection algorithm in the current security context to protect the integrity of subsequent uplink/downlink NAS messages. All messages without NAS integrity protection are not accepted and should be discarded, with the exception of some special NAS messages such as join request, location area update request, service request, control plane service request, authentication request, and identification request. For example, after the user equipment activates NAS integrity protection, each time the user equipment sends an uplink NAS message, the user equipment performs uplink NAS message integrity protection based on the NAS integrity key and the NAS integrity protection algorithm in the current security context ; Each time the user equipment receives a downlink NAS message, the user equipment performs an integrity check of the downlink NAS message based on the NAS integrity key and the NAS integrity protection algorithm in the current security context. For example, after the mobility network element activates NAS integrity protection, each time the mobility network element receives an uplink NAS message, the mobility network element performs an integrity check of the uplink NAS message based on the NAS integrity key and the security algorithm integrity of the NAS in the current security context; Each time the mobility network element sends a downlink NAS message, the mobility network element performs integrity protection of the downlink NAS message based on the NAS integrity key and the NAS integrity protection algorithm in the current security context.

[00191] Activating NAS encryption protection: After activating NAS encryption protection, it is necessary to use the NAS encryption key and NAS encryption algorithm in the current security context to encrypt subsequent uplink/downlink NAS messages. All messages not protected by NAS encryption are not accepted and must be deleted. For example, after the user equipment activates NAS encryption protection, each time the user equipment sends an uplink NAS message, the user equipment performs encryption protection of the uplink NAS message based on the NAS encryption key and the NAS encryption algorithm in the current security context; Each time the user equipment receives a downlink NAS message, the user equipment decrypts the downlink NAS message based on the NAS encryption key and the NAS encryption algorithm in the current security context. For example, after the mobility network element activates NAS integrity protection, each time the mobility network element receives an uplink NAS message, the user equipment decrypts the uplink NAS message based on the NAS encryption key and the NAS encryption algorithm in the current security context ; Each time the mobility network element sends a downlink NAS message, the mobility network element performs encryption protection on the downlink NAS message based on the NAS encryption key and the NAS encryption algorithm in the current security context.

[00192] 5. 5G-S-TMSI

[00193] A 5th generation-globally unique temporary identity (5G-GUTI) is assigned to the AMF terminal.

[00194] The structure of 5G-GUTI is as follows: 5G-GUTI = + +<AMF region ID> +<AMF set ID> +<AMF pointer> + <5G-TMSI>.

[00195] The mobile country code (MCC) is a three-digit decimal number and is used to identify a country.

[00196] The mobile network code is a 2 or 3 digit decimal number and is used to identify a telecom operator's network in a country.

[00197] The AMF area ID is eight bits and is used to identify a group of AMF sets (set).

[00198] The AMF Set ID occupies 10 bits and is used to identify the AMF group. An AMF group supports the same network segment.

[00199] The AMF pointer is six bits and is used to identify the AMF.

[00200] The 5th generation-temporary mobile subscriber identity (5G-TMSI) is 32 bits and is used to identify the AMF.

[00201] 5G-S-TMSI is the least significant 48 bits of 5G-GUTI. The structure of 5G-S-TMSI is as follows: 5G-S-TMSI =<AMF set ID> +<AMF pointer> + <5G-TMSI>.

[00202] In other words, the 5G-S-TMSI includes 48 bits, where bits one to ten are used to indicate the AMF set ID, bits eleven to sixteen are used to indicate the AMF indicator, and bits seventeen to forty-eight are used to 5G-TMSI instructions.

[00203] 6. Truncated parameter

[00204] This parameter is used to truncate the 5G-S-TMSI.

[00205] For example, the truncated parameter may include a first truncated parameter and a second truncated parameter. The first truncated parameter is used to truncate the AMF and 5G-TMSI set IDs. The second truncate parameter is used to truncate the AMF and 5G-TMSI pointer.

[00206] For ease of description, the first truncated parameter is denoted as n and the second truncated parameter is denoted as m below.

[00207] It should be noted that truncated 5G-S-TMSI =<truncated AMF Set ID> + <truncated AMF Indicator> +<truncated 5G-TMSI> .

[00208] The truncated AMF set ID includes the last n bits in the original AMF set ID.

[00209] The truncated AMF pointer includes the last m bits of the original AMF pointer.

[00210] The truncated 5G-TMSI includes the last 40-n-m bits in the original 5G-TMSI.

[00211] For example, 5G-TMSI=<0000001010 (10 bits)><000110 (6 bits)><000100... 10 (32 bits)>. Assuming n=5 and m=3, the truncated 5G-TMSI=<01010 (5 bits)><110 (3 bits)><000100... 10 (32 bits)>.

[00212] It should be noted that after receiving a truncated 5G-TMSI, the network access device can restore the truncated 5G-TMSI to the full 5G-TMSI by adding zeros.

[00213] The foregoing describes the terms used in the embodiments of the present application, and the details are not further described again.

[00214] CIoT terminals (such as electricity meters) that do not frequently transmit small packets require battery longevity. For example, this type of terminal requires that the battery can be used for 10 years. To meet battery life requirements, CIoT 5GS optimization function is designed in 5G technology. The feature where the terminal periodically sends measurement reports is removed using the CIoT 5GS optimization feature. Therefore, the source base station cannot receive signal data to instruct the terminal to perform the handover procedure. In this case, a terminal that uses the CIoT 5GS control plane optimization function cannot be transferred while moving to another base station through a handover procedure like a normal terminal. Therefore, for a terminal that uses the CIoT 5GS control plane optimization function, a re-establishment procedure is introduced to ensure session continuity while the terminal is moving.

[00215] In the re-establishment procedure, the RRC message reported by the terminal must carry the terminal's 5G-S-TMSI so that the network access device can determine a specific AMF based on the 5G-S-TMSI and the AMF can find the security context of the terminal based on 5G-S-TMSI. However, since the RRC message has a limited length and the length of the 5G-S-TMSI exceeds the maximum length of the RRC message, the RRC message cannot carry the full 5G-S-TMSI. Therefore, the terminal must truncate the 5G-S-TMSI using the truncated parameter so that the RRC message carries the truncated 5G-S-TMSI.

[00216] As shown in FIG. 4, according to the known technology, a procedure in which a network access device configures a truncated parameter for a terminal includes the following steps.

[00217] S10. The network access device pre-configures m and n.

[00218] S11. The terminal and the network side perform the registration procedure.

[00219] S12. The network access device sends an RRC reconfiguration message to the terminal, where the RRC reconfiguration message includes m and n.

[00220] S13. The terminal stores m and n.

[00221] S14. The terminal receives a truncated 5G-S-TMSI based on m, n and 5G-S-TMSI.

[00222] Optionally, a condition for the terminal to execute step S14 may be that a re-establishment procedure has been initiated.

[00223] S15. The terminal sends an RRC re-establishment request message to the network access device, where the RRC re-establishment request message includes the truncated 5G-S-TMSI.

[00224] It should be noted that the RRC re-establishment request message can carry a maximum of 67 bits of information. At least 27 bits in the RRC re-establishment request message shall be reserved for parameters other than 5G-S-TMSI. Therefore, the truncated 5G-S-TMSI carried in the RRC re-establishment request message cannot exceed 40 bits.

[00225] S16. The network access device reconstructs the 5G-S-TMSI based on m, n and the truncated 5G-S-TMSI.

[00226] In the procedure shown in FIG. 4, the AS security context is not established between the network access device and the terminal that uses the CIoT 5GS control plane optimization function. Therefore, AS security protection is not performed for the RRC message sent by the network access device to the terminal that uses the control plane CIoT 5GS optimization function. Therefore, a truncated parameter sent in an RRC message is at risk of being forged by an attacker.

[00227] To reduce the security risk of a truncated parameter during transmission, embodiments of the present application provide a method for protecting the truncated parameter and device. For the specific content of the method and device, see the following descriptions.

[00228] The technical solutions presented in the embodiments of the present application can be applied to various communication systems, for example, a 5G communication system, a future development system, or a variety of converged communication systems. The technical solutions presented in this application can be applied to a variety of application scenarios, such as machine-to-machine (M2M), macro-micro communications, enhanced mobile broadband (eMBB), ultra-reliable low-latency communications ( ultra reliable & low latency communication (uRLLC) and massive machine type communication (mMTC). These scenarios may include, but are not limited to, a communication scenario between communication devices, a communication scenario between network devices, a communication scenario between a network device and a communication device, and the like. The following are descriptions using an example in which technical solutions are applied to a scenario in which a network device communicates with a terminal.

[00229] In addition, the network architecture and service scenario described in the embodiments of the present application are intended to more clearly describe the technical solutions in the embodiments of the present application and do not impose limitations on the technical solutions provided in the embodiments of the present invention. One skilled in the art will recognize that as network architectures evolve and new service scenarios emerge, the technical solutions presented in the embodiments of this application are also applicable to similar technical problems.

[00230] FIG. 5 shows a 5G network architecture to which the technical solutions presented in the embodiments of the present application are applicable. A 5G network may include a terminal, a radio access network (RAN) or an access network (AN) (where RAN and AN are collectively referred to as (R)AN below), a core network (CN), and a data transmission (data network, DN).

[00231] The terminal may have a wireless transceiver function. A terminal may have different names, such as user equipment (UE), access terminal, terminal unit, terminal station, mobile station, mobile console, remote station, remote terminal, mobile device, wireless device, terminal agent, or terminal device. . The terminal can be deployed on land, including an indoor device, an outdoor device, a portable device or a vehicle-mounted device, or can be deployed on the surface of water (for example, on a ship), or can be deployed in the air (for example, on an airplane, balloon or satellite). A terminal includes a handheld device, a vehicle-mounted device, a wearable device, or a computing device that has a wireless communication function. For example, the terminal may be a mobile phone, a tablet computer, or a computer having a wireless transceiver function. Alternatively, the terminal device may be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in autonomous driving, a wireless terminal in telemedicine, a wireless terminal in smart network, a wireless a terminal in a smart city, a wireless terminal in a smart home, etc. In embodiments of the present application, the device for implementing the terminal function may be a terminal, or may be a device that can support the terminal in implementing the function, such as a chip system. In embodiments of the present application, the chip system may include a chip, or may include a chip and other discrete component. In the embodiments of the present application, an example in which the device for implementing the terminal function is a terminal is used to describe the technical solutions provided in the embodiments of the present application.

[00232] In embodiments of the present application, the terminal may be a terminal that uses the CIoT 5GS control plane optimization function. A terminal that uses the CIoT 5GS optimization feature transmits uplink and downlink subscriber data between the terminal and the SMF using the NAS message payload, without the need to establish a PDU session for the user plane connection. The terminal, which uses the CIoT 5GS optimization feature, and the AMF provide integrity protection and encryption of subscriber data using the NAS security context.

[00233] It should be noted that CIoT 5GS control plane optimization may also be referred to as CIoT 5GS control plane optimization. In embodiments of the present application this is not limited.

[00234] A network access device may also be referred to as a base station. There may be base stations in various forms, such as macro base station, micro base station (also called small cell), relay station and access point. In particular, the base station can be an access point (AP) in a wireless local area network (WLAN), a base transceiver station (BTS) in the Global System for Mobile Communications, GSM) or Code Division Multiple Access (CDMA), NodeB (NodeB, NB) in Wideband Code Division Multiple Access (WCDMA), eNB, relay station, access point, a vehicle-mounted or wearable device in LTE, a next generation NodeB (gNB) in a future 5G network, a base station in a future public land mobile network (PLMN), and etc.

[00235] A base station typically includes a baseband unit (BBU), a remote radio unit (RRU), an antenna, and a feeder used to connect the RRU and the antenna. The BBU is configured to be responsible for signal modulation. The RRU is configured to be responsible for RF processing. The antenna is configured to be responsible for the conversion between the pilot wave in the cable and the sky wave in the air. On the one hand, a distributed base station significantly reduces the feeder length between the RRU and the antenna, thereby reducing signal loss and reducing feeder cost. On the other hand, the RRU and antenna are relatively small and can be installed anywhere, making network planning more flexible. The RRU can be placed remotely. In addition, all BBUs can be centralized and located in the central office (CO). In this centralized manner, the number of hardware base stations can be significantly reduced, the power consumption of auxiliary devices, especially air conditioners, can be reduced, and carbon dioxide emissions can be significantly reduced. In addition, once distributed BBUs are integrated into the BBU baseband pool, BBUs can be managed and scheduled in a unified manner, and resources can be allocated more flexibly. In this mode, all physical base stations turn into virtual base stations. All virtual base stations exchange information such as data sent and received by users and channel quality in the BBU baseband pool, and cooperate with each other to realize joint scheduling.

[00236] In some deployments, a base station may include a centralized unit (CU) and a distributed unit (DU). The base station may further include an active antenna unit (AAU). The CU implements some base station functions and the DU implements some base station functions. For example, the CU is responsible for non-real-time protocol and service processing, and also implements functions of the RRC layer and the packet data convergence protocol (PDCP) layer. The DU is responsible for processing the physical layer protocol and real-time services, and also implements the functions of the radio link control (radio link control, abbreviated as RLC), media access control (MAC) layer, and physical (PHY) layer. The AAU implements some physical layer processing functions, RF processing, and an active antenna related function. Information at the RRC layer eventually becomes information at the PHY layer or is converted from information at the PHY layer. Therefore, in this architecture, higher layer signaling, such as RRC signaling or PDCP signaling, can also be considered as being transmitted by the DU or sent by the DU and the AAU. It can be understood that in embodiments of the present application, the network access device may be a device including one or more of a CU node, a DU node, and an AAU node. In addition, the CU may be classified as a network device in the RAN, or the CU may be classified as a network device in the core network (CN). It's not limited here.

[00237] In a possible base station design, the control plane (CP) and user plane (UP) of the CU may be further separated and implemented using different entities. In other words, CU can be divided into CU-CP and CU-UP.

[00238] The core network includes a plurality of core network elements (or referred to as network function network elements), such as an access and mobility management function (AMF) network element, a session management function (SMF) network element element, policy control function (PCF) network element, user plane function (UPF) network element, application function network element (authentication server function (AUSF) network element), and unified data management (UDM) network element.

[00239] In addition, the core network may further include some network elements not shown in FIG. 5, for example, the security anchor function (SEAF) network element and the authentication credential repository and processing function (ARPF). The details are not described herein in the embodiments of the present application.

[00240] The AMF network element is primarily responsible for mobility management processing, for example, functions such as access control, mobility management, attach and detach, and SMF selection. When an AMF network element provides a service for a session at a terminal, the AMF network element provides a control plane storage resource for the session to store a session identifier, an SMF identifier associated with the session identifier, and the like.

[00241] The terminal communicates with the AMF using the Next Generation (N) 1 interface, the RAN device communicates with the AMF using the N2 interface, the RAN device communicates with the UPF using the N3 interface ), and the UPF communicates with the DN using the N6 interface (N6 for short).

[00242] Control plane network elements, such as AMF, SMF, UDM, AUSF, or PCF, can also communicate with each other using service-oriented interfaces. For example, as shown in FIG. 5, service-oriented interface externally provided by AMF, may be Namf, service-oriented interface externally provided by SMF, may be Nsmf, service-oriented interface externally provided by UDM, may be Nudm, service-oriented interface externally provided by PCF, could be Npcf, and the service-oriented interface exposed externally by AUSF could be Nausf. The details are not described here.

[00243] FIG. 6 is a schematic diagram of a protocol stack according to an embodiment of the present application. As shown in FIG. 6, the terminal protocol stack includes at least a non-access layer, an RRC layer, a packet data convergence protocol (PDCP) layer, a radio link control (RLC) layer, and a media access control layer. (media access control, MAC) and physical layer (PHY layer). The RRC layer, PDCP layer, RLC layer, MAC layer and PHY layer belong to the access layer.

[00244] The non-access layer is a functional layer between the terminal and the core network and is used to support signaling and data transmission between the terminal and the network element (eg, mobility management network element) of the core network.

[00245] The RRC layer is used to support functions such as radio resource management and RRC connection management.

[00246] For definitions and functions of other protocol layers, such as the PDCP layer and the RLC layer, refer to the descriptions in the prior art. The details are not described here.

[00247] Optionally, all of the devices mentioned in the embodiments of the present application, such as a terminal, a mobility network element, and a network access device, may be implemented by the device shown in FIG. 7.

[00248] As shown in FIG. 7, device 100 includes at least one processor 101, communication line 102, memory 103, and at least one communication interface 104.

[00249] The processor 101 may be a general purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to control execution of the solution programs of the present application.

[00250] Communication line 102 is configured to transmit information between the aforementioned components.

[00251] Communication interface 104 is configured to communicate with another device or communication network, such as Ethernet, radio access network (RAN), or wireless local area networks (WLAN) through any device. for example a transceiver.

[00252] Memory 103 may be read-only memory (ROM) or other type of static storage device that can store static information and instructions, random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or may be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), or other compact disc storage device , an optical disc storage device (including a CD, laser disc, optical disc, digital versatile disc, Blu-ray optical disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store program code in the form of an instruction or data structure and can be accessed by a computer. However, memory doesn't stop there. The memory may exist independently and is coupled to the processor via communication line 102 . Alternatively, the memory may be integrated with the processor.

[00253] The memory 103 is configured to store a computer-executable instruction for executing the solutions of the present application, and the processor 101 controls the execution of the computer-executable instruction. The processor 101 is configured to execute a computer-executable instruction stored in the memory 103 to implement the technical solutions provided in the embodiments of the present application.

[00254] An optionally executable computing instruction in embodiments of the present application may also be referred to as application program code. This is not particularly limited in embodiments of the present application.

[00255] During a particular implementation, in an embodiment, processor 101 may include one or more processing units (CPUs), such as CPU 0 and CPU 1 in FIG. 7.

[00256] During a particular implementation in an embodiment, device 100 may include multiple processors, such as processor 101 and processor 107 in FIG. 7. Each of the processors can be a single-core (single-processor) processor or a multi-core (multi-processor) processor. A processor here may be one or more devices, circuits, and/or processor cores configured to process data (eg, computer program instructions).

[00257] During a particular implementation in an embodiment, device 100 may further include an output device 105 and an input device 106. The output device 105 interacts with the processor 101 and can display information in a variety of ways. For example, the output device 105 may be a liquid crystal display (LCD), a light emitting diode (LED), a cathode ray tube (CRT), or a projector. Input device 106 communicates with processor 101 and can receive input from a user in a variety of ways. For example, input device 106 may be a mouse, keyboard, touch screen device, or touch device.

[00258] The technical solutions presented in this application are described in detail below with reference to the accompanying drawings of the present specification.

[00259] To reduce the security risk of a truncated parameter during transmission, the present application provides the following three embodiments.

[00260] Embodiment 1 and Embodiment 3 may be applied to a scenario in which a terminal is accessing a network, and Embodiment 2 is applied to a scenario in which AMF updates a truncated parameter for a terminal served by AMF. It should be noted that the technical features included in the following three embodiments are related to each other, and the three embodiments can be combined with each other. For example, when terminal X, which uses the CIoT 5GS control plane optimization function, is registered with the network, execution of the solution in Embodiment 1 can be initiated to securely obtain the truncated parameter. Subsequently, the AMF on the network side also actively updates the truncated parameter of terminal X according to the method described in Embodiment 2.

Option 1:

[00261] FIG. 8 shows a method for protecting a truncated parameter according to an embodiment of the present application. The method includes the following steps.

[00262] S101. The network mobility control element determines whether a terminal accessing the network meets a predetermined condition.

[00263] In a 5G network, the mobility management network element may be an AMF. In a future mature system, the network mobility management element could be a NAS security endpoint similar to an AMF. This is a general description and is not covered in detail below.

[00264] In this embodiment of the present application, the predetermined condition includes at least that the terminal uses a CIoT 5GS control plane optimization function.

[00265] The optional predefined condition includes the following cases:

[00266] Case 1: The preset condition is that the terminal uses the CIoT 5GS control plane optimization function.

[00267] Based on Case 1, step S101 may be specifically implemented as follows: The mobility control network element determines whether the terminal uses the CIoT 5GS optimization function of the control plane. If the terminal uses the CIoT 5GS control plane optimization function, the mobility control network element determines that the terminal meets a predefined condition; or if the terminal does not use the CIoT 5GS control plane optimization function, the mobility control network element determines that the terminal does not meet a predefined condition.

[00268] In this embodiment of the present application, the mobility control network element determining whether the terminal uses the CIoT 5GS control plane optimization function includes the following implementations:

[00269] Implementation 1: The network mobility control element determines, based on the preferred network behavior reported by the terminal, whether the terminal uses the CIoT 5GS optimization function of the control plane.

[00270] The preferred network behavior may be conveyed in a registration request message sent by the terminal. Preferred network behavior is used to indicate the network function supported by the terminal. In other words, preferred network behavior is used to indicate the network function that the terminal prefers to use. For example, the preferred network behavior may indicate whether the terminal supports the control plane CIoT 5GS optimization function, whether the user plane CIoT 5GS optimization function supports, N3 data transmission, header compression, and the like.

[00271] Specifically, if the preferred network behavior reported by the terminal indicates that the terminal prefers to use a control plane CIoT 5GS optimization function, and the mobility control network element supports the control plane CIoT 5GS optimization function, the mobility control network element may determine that the terminal is using the function optimization of the CIoT 5GS control plane.

[00272] Alternatively, if the preferred network behavior reported by the terminal indicates that the terminal prefers to use the control plane CIoT 5GS optimization function, but the mobility control network element does not support the control plane CIoT 5GS optimization function, the mobility control network element may determine that the terminal does not use the CIoT 5GS control plane optimization feature.

[00273] Alternatively, if the preferred network behavior reported by the terminal indicates that the terminal does not prefer to use the control plane CIoT 5GS optimization function, the mobility control network element determines that the terminal does not use the control plane CIoT 5GS optimization function.

[00274] Implementation 2: The mobility control network element determines, based on the terminal context, whether the terminal uses the control plane CIoT 5GS optimization function.

[00275] Specifically, when the terminal context indicates that the terminal is using a 5GS control plane CIoT optimization function, the mobility control network element determines that the terminal is using a 5GS control plane CIoT optimization function. Alternatively, when the terminal context indicates that the terminal is not using the CIoT 5GS control plane optimization function, the mobility control network element determines that the terminal is not using the CIoT 5GS control plane optimization function.

[00276] It should be noted that if the terminal uses the CIoT 5GS control plane optimization function, no AS security context is established between the terminal and the network access device. Therefore, the truncated parameter cannot be passed in a manner known in the art to prevent an attacker from replacing the truncated parameter. Based on this, the mobility management network element needs to perform the next step S102.

[00277] Case 2: The preset condition is that the terminal uses the CIoT 5GS control plane optimization function, and the terminal is initially registered with the network.

[00278] Based on Case 2, step S101 may be specifically implemented as follows: The mobility control network element determines whether the terminal uses the CIoT 5GS optimization function of the control plane and whether the terminal is initially registered with the network. If the terminal uses the CIoT 5GS control plane optimization function and the terminal is initially registered with the network, the mobility network element determines that the terminal meets a predefined condition; or if the terminal does not use the CIoT 5GS control plane optimization function or the terminal is not initially registered with the network, the network mobility control element determines that the terminal does not meet a predefined condition.

[00279] In this embodiment of the present application, the network mobility control element determines, based on the registration type reported by the terminal, whether the terminal was initially registered with the network.

[00280] The registration type of the terminal may be carried into the registration request message sent by the terminal. The terminal registration type includes initial registration, mobility update registration, periodic registration update and emergency registration.

[00281] Specifically, when the terminal's registration type is initial registration, the mobility network element may determine that the terminal is initially registered with the network. Alternatively, when the terminal's registration type is mobility update registration, periodic registration update, or emergency registration, the network mobility control element may determine that the terminal is not initially registered with the network.

[00282] Optionally, in the registration procedure, the predefined condition may be the predefined condition in case 2.

[00283] It should be noted that the truncated parameter does not change frequently. Therefore, the network side does not need to send the truncated parameter to the terminal in each terminal registration procedure. Therefore, for a terminal that uses the CIoT 5GS control plane optimization function, if the terminal is initially registered in the network, the mobility control network element executes the following step S102 to ensure that the terminal receives the correct truncated parameter; if the terminal is not initially registered with the network, this indicates that the terminal stores the truncated parameter, and the network mobility control element may decide not to perform the next step S102 in order to reduce signaling overhead.

[00284] Case 3: The preset condition is that the terminal is using the control plane CIoT 5GS optimization function, and the terminal needs to update the truncated parameter.

[00285] Based on Case 3, step S101 may be specifically implemented as follows: The mobility control network element determines whether the terminal uses the control plane CIoT 5GS optimization function and whether the terminal needs to update the truncated parameter. If the terminal uses the CIoT 5GS control plane optimization function and the terminal needs to update the truncated parameter, the mobility network element determines that the terminal meets the predefined condition; or if the terminal does not use the CIoT 5GS control plane optimization function, or the terminal does not need to update the truncated parameter, the mobility network element determines that the terminal does not meet the predefined condition.

[00286] In this embodiment of the present application, the mobility control network element determining whether the terminal needs to update the truncated parameter includes one of the following implementations:

[00287] Implementation 1: The mobility network element determines whether the truncated parameter configured in the mobility network element is the same as the truncated parameter that is stored in the terminal context to determine whether the terminal needs to update the truncated parameter.

[00288] It should be noted that the mobility control network element stores in the terminal context the truncated parameter currently used by the terminal. That is, the truncated parameter stored in the terminal context is the truncated parameter currently used by the terminal.

[00289] When the truncated parameter configured in the mobility network element differs from the truncated parameter stored in the terminal context, the mobility network element may determine that the terminal needs to update the truncated parameter. Alternatively, when a truncated parameter configured in the mobility network element matches a truncated parameter stored in the terminal context, the mobility network element may determine that the terminal does not need to update the truncated parameter.

[00290] Implementation 2: The mobility control network element determines whether the current time is within a predefined time period to determine whether the terminal needs to update the truncated parameter.

[00291] The starting point of the predetermined time period is the moment at which the mobility network element determines that the truncated parameter is updated, and the duration of the predetermined time period is a predetermined duration. For example, the preset duration may be one minute or may be 10 minutes.

[00292] Optionally, the predetermined duration is greater than the periodic registration update time interval.

[00293] For example, the predetermined duration may be more than twice the periodic registration update time interval.

[00294] It should be noted that the network side may configure the periodic registration update time interval for the terminal, for example, 10 minutes. After the terminal's idle time exceeds the time interval, the terminal actively initiates a registration request so that the network side knows that the terminal is still online. Therefore, if the network side sets a preset duration to be more than twice the periodic registration update time interval within the preset duration, the network mobility control element can ensure that all online terminals can update the truncated parameter.

[00295] That is, when the current time is within a predetermined time period, the mobility control network element determines that the terminal needs to update the truncated parameter. When the current time is not within a predetermined time period, the mobility network element determines that the terminal does not need to update the truncated parameter.

[00296] Optionally, in a scenario in which the truncated parameter is updated, the predefined condition may be the predefined condition in case 3.

[00297] It should be noted that for the method of updating the truncated parameter by the mobility management network element, refer to the following description of step S401. The details are not described here.

[00298] It should be noted that regardless of whether the terminal stores the truncated parameter, when the network side updates the truncated parameter, the network side must send the updated truncated parameter to the terminal to prevent the terminal from receiving an incorrect truncated 5G-S-TMSI with the truncated parameter that was before the update. Therefore, for a terminal that uses the CIoT 5GS control plane optimization function, when the mobility network element determines that the terminal needs to update the truncated parameter, the mobility network element performs the next step S102 to ensure that the terminal can obtain the latest truncated parameter, thereby ensuring that the terminal can normally access the network; when the mobility network element determines that the terminal does not need to update the truncated parameter, the mobility network element may not perform the next step S102 to reduce signaling overhead.

[00299] It should be noted that the above cases 1 to 3 are merely examples of preset conditions, and this embodiment of the present application is not limited to them.

[00300] S102. The mobility network element sends to the terminal, when the terminal meets a predetermined condition, a downlink NAS message in which NAS security protection is performed using the NAS security context, where the downlink NAS message includes a truncated parameter.

[00301] Optionally, the network mobility control element may previously store the truncated parameter, or the network mobility control element may obtain the truncated parameter from the network access device.

[00302] NAS security protection includes, at a minimum, integrity protection. Optionally, NAS security protection further includes encryption protection.

[00303] It can be understood that since NAS security protection is performed on the downlink NAS message, NAS security protection is also performed on the truncated parameter in the downlink NAS message, so that the security of the truncated parameter can be ensured.

[00304] It should be noted that the downlink NAS message may be new signaling, or the signaling in an existing procedure may be reused.

[00305] For example, in a registration procedure, the downlink NAS message may be a registration accept message.

[00306] As another example, in a service request procedure, the downlink NAS message may be a servers accept message.

[00307] S103. The terminal performs security deprotection on the downlink NAS.

[00308] When the NAS security protection performed on the downlink NAS message is integrity protection, removing the security protection is an integrity check. Alternatively, when integrity protection and encryption protection are performed on the downlink NAS message, removing the security protection is an integrity check and decryption.

[00309] S104. The terminal stores the truncated parameter after successfully deprotecting the downlink NAS message.

[00310] In an exemplary implementation, after the terminal NAS layer successfully performs security deprotection on the downlink NAS message, the terminal NAS layer stores the truncated parameter.

[00311] In another possible implementation, after the terminal NAS layer successfully removes security protection from the downlink NAS message, the terminal NAS layer sends the truncated parameter to the terminal RRC layer, and the terminal RRC layer stores the truncated parameter.

[00312] Based on the technical solution shown in FIG. 8, since the preset condition includes at least that the terminal uses the CIoT 5GS control plane optimization function, that the terminal meets the preset condition indicates that the terminal uses the CIoT 5GS control plane optimization function. When determining that the terminal is using the control plane CIoT 5GS optimization function, the mobility control network element sends the terminal a downlink NAS message in which NAS security protection is performed using the NAS security context to ensure that NAS security protection is performed for the truncated parameter in transfer process. This ensures that the truncated parameter is not replaced or tampered with, thereby avoiding a denial of service attack launched by an attacker against the terminal, and further ensuring that the terminal can normally access the network.

[00313] Next, the technical solution shown in FIG. 8 with reference to specific application scenarios.

[00314] Scenario 1: The mobility network element previously stores a truncated parameter.

[00315] Based on scenario 1 in FIG. 9 shows a method for protecting a truncated parameter according to an embodiment of the present application. The method includes the following steps.

[00316] S200. The network mobility control element previously stores the truncated parameter.

[00317] Optionally, the operator may configure a truncated parameter for the network mobility control element using the network management system so that the network mobility control element can previously store the truncated parameter.

[00318] In an exemplary embodiment, the truncated parameter may have a granularity of PLMN or may have a granularity of a region. That is, a truncated parameter configured in the network management system may be applicable to the entire PLMN network or only to a region.

[00319] The specific implementation of how the mobility management network element pre-configures the truncated parameter is not limited in this embodiment of the present application.

[00320] S201. The terminal sends an uplink NAS message to the mobility network element, so that the mobility network element receives the uplink NAS message sent by the terminal.

[00321] For example, the uplink NAS message may be a registration request message, a service request message, or the like. This is not limited in this embodiment of the present application.

[00322] It should be noted that the registration request message may include a registration type (5GS registration type) and a preferred network behavior.

[00323] S202. The terminal and network mobility element enable NAS security.

[00324] For example, the uplink NAS message is a registration request message. After the mobility network element receives the registration request message, the mobility network element performs an authentication and key agreement (AKA) procedure for the terminal. Then, after successful authentication, the network mobility control element and the terminal activate the NAS security context between the terminal and the network mobility control element using the NAS security mode command (SMC) procedure.

[00325] For example, the uplink NAS message is a service request message. After the mobility network element receives the service request message, the mobility network element performs an integrity check of the service request message. After successfully verifying the integrity of the service request message, the mobility network element activates a NAS security context between the terminal and the mobility network element.

[00326] S203-S206 are the same as steps S101-S104. For specific descriptions thereof, refer to the embodiment shown in FIG. 8. The details are not repeated here.

[00327] Optionally, when the uplink NAS message is a registration request message, the downlink NAS message is a registration acceptance message.

[00328] Optionally, when the uplink NAS message is a service request message, the downlink NAS message is a service acceptance message.

[00329] Based on the embodiment shown in FIG. 9, in some procedures, such as a registration procedure or a service request procedure, the mobility control network element may actively determine whether the terminal meets a predetermined condition. The mobility network element sends to the terminal, when the terminal meets a predetermined condition, a truncated parameter on which NAS security protection is performed, so that the terminal can use the truncated parameter in a subsequent procedure.

[00330] Scenario 2: The network access device previously stores the truncated parameter.

[00331] Based on scenario 2 in FIG. 10 shows a method for protecting a truncated parameter according to an embodiment of the present application. The method includes the following steps.

[00332] S300. The network access device first stores the truncated parameter.

[00333] It should be noted that the network access device typically pre-configures the truncated parameter, such that the network access device reconstructs the full 5G-S-TMSI based on the truncated parameter and the truncated 5G-S-TMSI.

[00334] Additionally, the operator can configure the truncated parameter for the network access device using the network management system so that the network access device can pre-store the truncated parameter.

[00335] In an exemplary embodiment, the truncated parameter may have a granularity of PLMN or may have a granularity of a region. That is, a truncated parameter configured in the network management system may be applicable to the entire PLMN network or only to a region.

[00336] The specific implementation of how the network access device pre-configures the truncated parameter is not limited in this embodiment of the present application.

[00337] S301. The terminal sends an uplink RRC message to the network access device.

[00338] For example, the uplink RRC message may be an RRC Establishment Request message or an RRC Establishment Complete message. This is not limited in this embodiment of the present application.

[00339] Optionally, in addition to the uplink RRC message, the terminal may further send an uplink NAS message to the network access device, such that the network access device forwards the uplink NAS message to the network mobility control element. For example, the uplink NAS message may be a registration request message or a service request message. This is not limited in this embodiment of the present application.

[00340] In an exemplary embodiment, the uplink NAS message may be used as the payload of the uplink RRC message. For example, the uplink RRC message includes a NAS container, and the NAS container includes the uplink NAS message. That is, the terminal sends an uplink RRC message to the network access device to transmit the uplink RRC message and the uplink NAS message together to the network side.

[00341] In another possible implementation, the terminal separately sends an uplink NAS message and an uplink RRC message to the network access device.

[00342] S302. The network access device determines whether the terminal supports the CIoT 5GS optimization function.

[00343] The CIoT 5GS optimization function includes a CIoT 5GS user plane optimization function and/or a CIoT 5GS control plane optimization function.

[00344] That is, the terminal supports a CIoT 5GS optimization function, which indicates that the terminal can support a user plane CIoT 5GS optimization function and/or a control plane CIoT 5GS optimization function.

[00345] Optionally, at step S302, at least one of the following implementations is used:

[00346] Implementation 1: When the uplink RRC message includes a capability indication, the network access device determines based on the capability indication whether the terminal supports the CIoT 5GS optimization function. Specifically, if the capability indication is used to indicate that the terminal supports the 5GS CIoT optimization function, the network access device determines that the terminal supports the 5GS CIoT optimization function.

[00347] Additionally, if the capability indication does not indicate that the terminal supports the 5GS CIoT optimization function, the network access device determines that the terminal does not support the 5GS CIoT optimization function.

[00348] Implementation 2: The network access device determines, based on the access frequency of the terminal, whether the terminal supports the CIoT 5GS optimization function. Specifically, if the frequency used by the CIoT device is the access frequency of the terminal, the network access device determines that the terminal supports the CIoT 5GS optimization function.

[00349] Additionally, if the frequency used by the terminal is not the access frequency of the CIoT device, the network access device determines that the terminal does not support the CIoT 5GS optimization function.

[00350] Implementation 3: The network access device determines, based on the type of message sent by the terminal, whether the terminal supports the CIoT 5GS optimization function. Specifically, if the message type sent by the terminal matches the message type intended for the CIoT device, the network access device determines that the terminal supports the CIoT 5GS optimization feature.

[00351] Optionally, if the message type sent by the terminal is different from the message type intended for the CIoT device, the network access device determines that the terminal does not support the CIoT 5GS optimization feature.

[00352] It can be understood that implementations 1 to 3 are simply examples of specific implementations of step S302. In real-life applications, Implementation 1, Implementation 2, and/or Implementation 3 may be used in combination.

[00353] Note that if the network access device determines that the terminal supports the CIoT 5GS optimization function, the network access device executes the next step S303.

[00354] S303. The network access device sends an N2 message to the mobility network element, such that the mobility network element receives the N2 message sent by the network access device.

[00355] Message N2 includes a truncated parameter.

[00356] Optionally, the N2 message may be an Initial UE message.

[00357] Optionally, when the terminal further sends the uplink NAS message to the network access device, the N2 message carries the uplink NAS message.

[00358] S304-S307 are the same as steps S101-S104. For specific descriptions thereof, refer to the embodiment shown in FIG. 8. The details are not repeated here.

[00359] Based on the embodiment shown in FIG. 10, when the network access device stores the truncated parameter, the network access device determines whether the accessed terminal supports the CIoT 5GS optimization function. The network access device then sends the truncated parameter to the network mobility control element when the terminal supports the CIoT 5GS optimization function, so that in a subsequent procedure, the network mobility control element can send to the terminal that uses the control plane CIoT 5GS optimization function the truncated parameter on which security protection is performed. NAS In the previous process, the network mobility control may receive a truncated parameter from the network access device. Therefore, the mobility network element does not need to pre-configure the truncated parameter, thereby reducing the complexity of configuring the truncated parameter.

Option 2 implementation:

[00360] FIG. 11 shows a method for protecting a truncated parameter according to an embodiment of the present application. The method includes the following steps.

[00361] S401. The network mobility control element updates the truncated parameter.

[00362] Optionally, step S401 may include one of the following implementations:

[00363] Implementation 1: The mobility network element updates the truncated parameter based on the number of AMF set IDs and/or the number of AMF pointers.

[00364] For example, if an AMF set ID and/or an AMF pointer that is truncated based on the current truncated parameter cannot represent all allocated network mobility controls, the network mobility control element must adjust the truncated parameter.

[00365] For example, for the current truncated parameter, the value of n is 5 and the value of m is 3. In this case, the truncated AMF set ID has only five bits, and the total number of AMF sets that can be specified by the truncated AMF set ID is 32; The AMF truncated pointer has only three bits, and the total number of pointers that can be pointed by the AMF truncated pointer is 8. If the current number of AMF sets is 14 and the current number of pointers is 9, the mobility network element needs to update the truncated parameter. Optionally, for an updated truncated parameter, n can be adjusted to 4 and m can be adjusted to 4. Thus, the total number of AMF sets that can be specified by a truncated AMF set ID is 16, and the total number of pointers that can be specified AMF truncated pointer is equal to 16.

[00366] Implementation 2: The mobility management network element updates the truncated parameter in accordance with the instructions of the network management system.

[00367] Optionally, the network management system may be an operation administration and maintenance (OAM) system.

[00368] Implementation 3: The network mobility control element receives the updated truncated parameter sent by the network access device.

[00369] It should be noted that the network access device may update the truncated parameter in accordance with the instruction of the network management system.

[00370] S402. The mobility control network element looks for a terminal that uses the CIoT 5GS control plane optimization feature.

[00371] In an exemplary implementation, the mobility control network element stores the terminal context, and the terminal context includes indication information indicating whether the corresponding terminal uses a control plane CIoT 5GS optimization function. The mobility network element determines, based on the contexts of a plurality of terminals that are stored in the mobility network element, a terminal that uses the control plane CIoT 5GS optimization function.

[00372] It is understood that there may be one or more terminals using the CIoT 5GS control plane optimization function.

[00373] S403. The mobility control network element sends to a terminal that uses the control plane CIoT 5GS optimization function a downlink NAS message in which NAS security protection is performed using the NAS security context.

[00374] The downlink NAS message includes an updated truncated parameter.

[00375] For any terminal that uses the CIoT 5GS control plane optimization function, the mobility control network element sending a downlink NAS message to the terminal includes one of the following implementations:

[00376] Implementation 1: If the terminal that uses the CIoT 5GS control plane optimization function is in the CONNECTED state, the mobility network element may directly send to the terminal that uses the CIoT 5GS control plane optimization function a downlink NAS message. in which NAS security protection is performed using the NAS security context.

[00377] Optionally, based on implementation 1, the downlink NAS message may be a UE Configuration Update Command message.

[00378] Implementation 2: If a terminal that uses the CIoT 5GS control plane optimization function is in an unconnected state, the mobility control network element waits for the terminal to transition to a connected state. After the terminal enters the connected state and NAS security is activated, the mobility network element sends a downlink NAS message to the terminal in which NAS security protection is performed using the NAS security context.

[00379] In this embodiment of the present application, the unconnected state may be an idle state or an inactive RRC state.

[00380] It should be noted that a terminal in an unconnected state may actively initiate a service request message to enter a connected state.

[00381] Optionally, based on Implementation 2, the downlink NAS message may be a service acceptance message or a UE configuration update control message.

[00382] Implementation 3: If a terminal that uses the CIoT 5GS control plane optimization function is in an unconnected state, the mobility control network element paging the terminal to cause the terminal to transition to a connected state. After the terminal enters the connected state and NAS security is activated, the mobility network element sends a downlink NAS message to the terminal in which NAS security protection is performed using the NAS security context.

[00383] Optionally, based on implementation 3, the downlink NAS message may be a service acceptance message or a UE Configuration Update Command message.

[00384] It should be noted that when the terminal is in an unconnected state, the terminal does not need to truncate the 5G-S-TMSI. Therefore, a terminal in an unconnected state does not need to immediately update the truncated parameter. In this case, the mobility network element updates the truncated parameter for the terminal after the terminal is restored to the connected state to prevent the mobility network element from simultaneously sending a large number of NAS signals to the terminal, thereby avoiding signaling congestion.

[00385] In addition, based on Implementation 3, the mobility control network element does not actively “wake up” a terminal that is in an unconnected state, which helps reduce power consumption of the terminal.

[00386] S404 and S405 are the same as steps S103 and S104. For specific descriptions thereof, refer to the embodiment shown in FIG. 8. The details are not repeated here.

[00387] Based on the technical solution shown in FIG. 11, after updating the truncated parameter, the network mobility control element actively sends the updated truncated parameter on which NAS security protection is performed to the terminal, which uses the CIoT 5GS optimization function of the control plane, so that the terminal can obtain the updated truncated parameter. This avoids the case where the terminal cannot access the network normally because the terminal is using an incorrect truncated parameter.

Option 3 implementation:

[00388] FIG. 12 shows a method for protecting a truncated parameter according to an embodiment of the present application. The method includes the following steps.

[00389] S500-S503 are the same as steps S300-S303. For specific descriptions thereof, refer to the embodiment shown in FIG. 10. The details are not repeated here.

[00390] Optionally, in addition to the truncated parameter, the network access device may additionally send a relevance parameter and/or security indication information to the network mobility control element.

[00391] The relevance parameter is used to calculate the integrity of the truncated parameter, and the relevance parameter is used to ensure that the NAS MACs generated twice are different. For example, the relevance parameter may be a downlink PDCP counter (count).

[00392] Security indication information is used to instruct the mobility network element to perform security protection on the truncated parameter.

[00393]S504. The mobility network element performs a truncated parameter integrity calculation based on the NAS security context to generate the first NAS MAC.

[00394] In an exemplary implementation, when the mobility network element receives a truncated parameter, the mobility network element performs an integrity calculation of the truncated parameter to generate a first NAS MAC.

[00395] In another possible implementation, when the mobility network element receives the truncated parameter and security indication information, the mobility network element performs an integrity calculation of the truncated parameter to generate a first NAS MAC. When the mobility network element receives a truncated parameter but does not receive security instruction information, the mobility network element does not perform an integrity calculation of the truncated parameter.

[00396] Optionally, the mobility network element generates a first NAS MAC based on an integrity protection key, a truncated parameter, and an integrity protection algorithm.

[00397] Optionally, when the network access device sends the relevance parameter to the network mobility control element, the network mobility control element generates a first NAS MAC based on the integrity protection key, the truncated parameter, the integrity protection algorithm and the relevance parameter.

[00398]S505. The mobility network element sends the first NAS MAC to the network access device, such that the network access device receives the first NAS MAC sent by the mobility network element.

[00399]S506. The network access device sends the truncated parameter and the first NAS MAC to the terminal, so that the terminal receives the truncated parameter and the first NAS MAC sent by the network access device.

[00400] The truncated parameter and the first NAS MAC may be carried in the downlink RRC message.

[00401] Optionally, the downlink RRC message further carries an indication of the relevance parameter, and the indication of the relevance parameter may be several bits of the downlink PDCP counter.

[00402] For example, the downlink RRC message may be an RRC reconfiguration message. This is not limited in this embodiment of the present application.

[00403] S507. The terminal performs a truncated parameter integrity calculation based on the NAS security context to form a second NAS MAC.

[00404] Additionally, the terminal generates a second NAS MAC based on the integrity protection key, the truncated parameter, and the integrity protection algorithm.

[00405] Optionally, when the terminal further receives the relevance parameter indication sent by the network access device, the terminal generates a second NAS MAC based on the integrity protection key, the truncated parameter, the relevance parameter and the integrity protection algorithm.

[00406] It should be noted that after the terminal receives the relevance parameter indication, the terminal may obtain the relevance parameter based on the relevance parameter indication. For example, the terminal reconstructs the complete downlink PDCP COUNT based on some downlink PDCP COUNT bits.

[00407] S508. The terminal checks the first NAS MAC based on the second NAS MAC.

[00408] In a possible implementation, the terminal determines whether the second NAS MAC is the same as the first NAS MAC. If the first NAS MAC matches the second NAS MAC, the terminal determines that the verification of the first NAS MAC is successful. If the first NAS MAC is different from the second NAS MAC, the terminal determines that verification of the first NAS MAC has failed.

[00409] S509. The terminal saves the truncated parameter after successfully checking the first NAS MAC.

[00410] In a possible implementation, after successful verification of the first NAS MAC, the RRC layer of the terminal stores the truncated parameter.

[00411] In another possible implementation, after successful verification of the first NAS MAC, the RRC layer of the terminal sends the truncated parameter to the NAS layer of the terminal. The terminal NAS layer then stores the truncated parameter.

[00412] Based on the technical solution shown in FIG. 12, when the network access device needs to send a truncated parameter to the terminal, the network access device first sends the truncated parameter to the network mobility control element to obtain the first NAS MAC corresponding to the truncated parameter. The network access device then sends the truncated parameter and the first NAS MAC to the terminal. Thus, using the first NAS MAC, the terminal can check whether the truncated parameter has been modified by an attacker, thereby guaranteeing the integrity of the truncated parameter. When the terminal receives the correct truncated parameter, the terminal can usually access the network.

[00413] When a radio link failure (RLF) occurs, a terminal that uses the CIoT 5GS control plane optimization function may initiate an RRC connection re-establishment procedure. In the RRC connection re-establishment procedure, the terminal must send an RRC Re-establishment Request message to the target network access device, and the RRC Re-establishment Request message carries the truncated 5G-S-TMSI.

[00414] Therefore, the UE needs to obtain the truncated 5G-S-TMSI in the RRC connection re-establishment procedure.

[00415] Optionally, the terminal receiving the truncated 5G-S-TMSI includes one of the following implementations:

[00416] Implementation 1: When the terminal RRC layer is responsible for storing the truncated parameter, when the terminal needs to use the truncated 5G-S-TMSI, the terminal RRC layer truncates the 5G-S-TMSI based on the truncated parameter to obtain the truncated 5G-S-TMSI.

[00417] Implementation 2: When the RRC layer of the terminal is responsible for storing the truncated parameter, when the terminal needs to use the truncated 5G-S-TMSI, the RRC layer of the terminal sends the truncated parameter to the NAS layer of the terminal. The terminal NAS layer truncates the 5G-S-TMSI based on the truncated parameter to obtain a truncated 5G-S-TMSI. The NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[00418] Implementation 3: When the terminal NAS layer is responsible for storing the truncated parameter, when the terminal needs to use the truncated 5G-S-TMSI, the terminal NAS layer truncates the 5G-S-TMSI based on the truncated parameter to obtain the truncated 5G-S-TMSI. The NAS layer of the terminal sends the truncated 5G-S-TMSI to the RRC layer of the terminal.

[00419] Implementation 4: When the terminal NAS layer is responsible for storing the truncated parameter, when the terminal needs to use the truncated 5G-S-TMSI, the terminal NAS layer sends the truncated parameter to the terminal RRC layer. The terminal RRC layer then truncates the 5G-S-TMSI based on the truncated parameter to obtain a truncated 5G-S-TMSI.

[00420] It can be understood that the truncated parameter stored in the terminal is obtained by the terminal using the technical solution shown in any of FIGS. 8 according to FIG. 12.

[00421] The following describes in detail the RRC connection re-establishment procedure for a terminal that uses the CIoT 5GS control plane optimization function.

[00422] A terminal that uses the CIoT 5GS control plane optimization feature does not have an AS security context available. Therefore, to protect the re-establishment procedure, the AS layer of the terminal instructs the NAS layer to provide UL_NAS_MAC and XDL_NAS_MAC. UL_NAS_MAC indicates that the terminal is requesting to re-establish an RRC connection, and XDL_NAS_MAC is used to indicate that the terminal is in connection with the real network.

[00423] Note that the terminal sets Key to Key Integrity (KNASint), sets Counter to the uplink NAS counter value, sets DIRECTION to 0, and sets Message to the target cell identifier (Cell ID) and the complete RRC re-establishment request message , which excludes the least significant bit (LSB) of the NAS and UL_NAS_MAC counter. The terminal then inputs these parameters (eg, key and message) into the currently used integrity algorithm to form the NAS MAC.

[00424] The first 16 bits of the NAS MAC form the UL_NAS_MAC, and the last 16 bits of the NAS MAC form the XDL_NAS_MAC.

[00425] The terminal then sends an RRC re-establishment request message to the target network access device, where the RRC re-establishment request message includes the truncated 5G-S-TMSI and the least significant five bits of the NAS counter. The least significant bits of the NAS counter are used to calculate the NAS MAC.

[00426] The target network access device reconstructs the full 5G-S-TMSI based on the truncated 5G-S-TMSI in the RRC re-establishment request message and the locally configured truncated parameter (m and n). The target network access device can determine, based on the full 5G-S-TMSI, the network mobility control element serving the terminal. In addition, the target network access device sends the 5G-S-TMSI, the target cell ID and the entire RRC re-establishment request message except the truncated 5G-S-TMSI to the network mobility control element.

[00427] The mobility management network element estimates the full uplink NAS counter using the LSB of the NAS counter associated with the NAS connection ID "0x01". The mobility network element then uses the estimated number of uplink NAS to calculate the XNAS-MAC.

[00428] The mobility control network element compares whether the first 16 bits of UL_NAS_MAC match the XNAS-MAC bits. When the first 16 bits of UL_NAS_MAC match the XNAS-MAC bits, the mobility network element determines that the real terminal is sending an RRC re-establishment request message.

[00429] The network mobility control element then sends a connection establishment indication message to the target network access device, where the connection establishment indication message includes DL_NAS_MAC. It should be noted that DL_NAS_MAC is the last 16 bits of XNAS-MAC.

[00430] The network access device sends an RRC Reestablishment message to the terminal, where the RRC Reestablishment message includes DL_NAS_MAC.

[00431] The terminal checks whether the received DL_NAS_MAC matches the XDL_NAS_MAC. If DL_NAS_MAC and XDL_NAS_MAC match, the terminal completes the RRC connection re-establishment procedure.

[00432] The foregoing mainly describes the solutions provided in the embodiments of the present application from the point of view of interaction between network elements. It can be understood that in order to implement the above functions, each network element, such as a terminal, a network access device and a mobility management network element, includes a corresponding hardware structure or software module for performing each function or a combination thereof. One skilled in the art will appreciate that the blocks, algorithms, and steps in the examples described with reference to the embodiments disclosed herein may be implemented in hardware or a combination of hardware and computer software in this application. Whether a function is performed by hardware or hardware controlled by computer software depends on the specific applications and design limitations of the technical solutions. One skilled in the art may employ various methods to implement the described functions for each particular application, but such implementation should not be considered beyond the scope of this application.

[00433] In embodiments of the present application, functional modules of the network access device, network mobility control element and terminal can be obtained by partitioning based on the above example methods. For example, each functional module can be obtained by partitioning on the basis of each corresponding function, or two or more functions can be integrated into one processing module. The integrated module may be implemented as hardware or may be implemented as a software function module. It should be noted that in this embodiment of the present application, the moduleization is exemplary and is simply a logical division of functions. In actual implementation, a different separation method may be used. An example in which each function module is obtained by dividing based on each corresponding function is used below for description.

[00434] FIG. Fig. 13 is a schematic structure diagram of a terminal according to an embodiment of the present application. As shown in FIG. 13, the terminal includes a communication module 201, a processing module 202, and a storage module 203. The communication module 201 is configured to support the terminal when executing step S102 in FIG. 8, steps S201 and S204 in FIG. 9, steps S301 and S305 in FIG. 10, step S403 in FIG. 11, steps S501 and S506 in FIG. 12, and/or other communication operation to be performed by the terminal in embodiments of the present application. The processing unit 202 is configured to support the terminal when executing step S103 in FIG. 8, steps S202 and S205 in FIG. 9, step S306 in FIG. 10, step S404 in FIG. 11, steps S507 and S508 in FIG. 12, and/or other processing operation to be performed by the terminal in embodiments of the present application. The storage unit 203 is configured to support the terminal when executing step S104 in FIG. 8, step S206 in FIG. 9, step S307 in FIG. 10, step S405 in FIG. 11, step S509 in FIG. 12, and/or other storage operation to be performed by the terminal in embodiments of the present application.

[00435] In the example referring to the device shown in FIG. 7, processing module 202 in FIG. 13 may be implemented by processor 101 in FIG. 7 communication module 201 in FIG. 13 may be implemented by communication interface 104 in FIG. 7, and storage module 203 in FIG. 13 may be implemented by memory 103 in FIG. 7. In embodiments of the present application this is not limited.

[00436] FIG. 14 is a schematic block diagram of a network access device according to an embodiment of the present application. As shown in FIG. 14, the network access device includes a communication module 301, a processing module 302, and a storage module 303. The communication module 301 is configured to support the network access device when executing steps S301 and S303 in FIG. 10, steps S501, S503, S505 and S506 in FIG. 12, and/or other communication operation to be performed by the network access device in embodiments of the present application. The processing unit 302 is configured to support the network access device when executing step S302 in FIG. 10, step S502 in FIG. 12, and/or other processing operation to be performed by the network access device in embodiments of the present application. The storage unit 303 is configured to support the network access device when executing step S300 in FIG. 10, step S500 in FIG. 12, and/or other storage operation to be performed by the network access device in embodiments of the present application.

[00437] In the example referring to the device shown in FIG. 7, processing module 302 in FIG. 14 may be implemented by processor 101 in FIG. 7 communication module 301 in FIG. 14 may be implemented by communication interface 104 in FIG. 7, and storage module 303 in FIG. 14 may be implemented by memory 103 in FIG. 7. In embodiments of the present application this is not limited.

[00438] FIG. 15 is a schematic structure diagram of a mobility management network element according to an embodiment of the present application. As shown in FIG. 15, the mobility network element includes a communication module 401, a processing module 402, and a storage module 403. The communication module 401 is configured to support the network mobility control element when executing step S102 in FIG. 8, steps S201 and S204 in FIG. 9, steps S303 and S305 in FIG. 10, step S403 in FIG. 11, steps S503 and S505 in FIG. 12, and/or other communication operation to be performed by the mobility management network element in embodiments of the present application. The processing unit 402 is configured to support the network mobility control element when executing step S101 in FIG. 8, steps S202 and S203 in FIG. 9, step S304 in FIG. 10, steps S401 and S402 in FIG. 11, step S504 in FIG. 12, and/or other processing operation to be performed by the mobility management network element in embodiments of the present application. The storage module 403 is configured to support the network mobility control element when executing step S200 in FIG. 9, and/or other storage operation to be performed by the mobility management network element in embodiments of the present application.

[00439] In the example referring to the device shown in FIG. 7, processing module 402 in FIG. 15 may be implemented by processor 101 in FIG. 7 communication module 401 in FIG. 15 may be implemented by communication interface 104 in FIG. 7, and storage module 403 in FIG. 15 may be implemented by memory 103 in FIG. 7. In embodiments of the present application this is not limited.

[00440] An embodiment of this application further provides a computer-readable storage medium. The computer-readable medium stores the instruction, and when the computer-readable medium is operated by the computer, the computer is able to perform the truncated parameter protection method provided in the embodiments of the present application.

[00441] An embodiment of the present application further provides a computer program product including computer instructions. When a computer program product is executed on a computer, the computer is able to execute the truncated parameter protection method provided in the embodiments of the present application.

[00442] An embodiment of the present application provides a microcircuit. The chip includes the processor. When executing the instruction, the processor allows the chip to execute the truncated parameter protection method provided in the embodiments of the present application.

[00443] It should be understood that a computer instruction may be stored on a computer readable storage medium or may be transmitted from a computer readable storage medium to another computer readable storage medium. For example, a computer instruction may be transmitted from a website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic cable, or digital subscriber unit) or wireless ( for example, infrared, radio or microwave) method. A computer-readable storage medium can be any usable media accessible to a computer, or a storage device, such as a server or data center, combining one or more usable media. The medium used may be a magnetic medium (eg, a floppy disk, a hard disk, or a magnetic tape), an optical medium, a semiconductor medium (for example, a solid state drive), or the like.

[00444] The above descriptions of implementations allow one skilled in the art to clearly understand that, for the purpose of convenient and concise description, the division into only the above-mentioned functional modules is used as an example for illustration. In actual application, the above functions can be assigned to different function modules for implementation based on the requirement, that is, the internal structure of the device is divided into various function modules to implement all or some of the functions described above.

[00445] It should be understood that in several embodiments presented herein, the disclosed devices and methods may be implemented in other ways. For example, the described embodiments of the device are merely examples. For example, division into modules or blocks is simply a logical functional division. In a real implementation there may be a different way of dividing. For example, multiple blocks or components may be combined or integrated into another device, or some functionality may be ignored or not implemented. In addition, the mutual connections or direct connections or communication connections displayed or discussed may be implemented through some interfaces. Indirect connections or communication connections between devices or units may be implemented in electrical form, mechanical form, or other form.

[00446] Blocks described as individual components may or may not be physically separate, and components depicted as blocks may be one or more physical blocks, that is, they may be located in one location or may be distributed over many different locations. Some or all of the blocks may be selected based on actual requirements to achieve the objectives of the solutions in the mentioned embodiments.

[00447] In addition, the functional blocks in embodiments of the present application may be integrated into a single processing block, or each of the blocks may exist separately physically, or two or more blocks are integrated into a single block. block. The integrated block may be implemented as hardware or may be implemented as a software functional block.

[00448] When an integrated block is implemented as a software functional block and is sold or used as an independent product, the integrated block may be stored on a readable storage medium. Based on this understanding, the technical solutions in the embodiments of the present application, essentially or a part that contributes to existing technology, or all or some of the technical solutions may be implemented in the form of a software product. The software product is stored on a storage medium and includes a number of instructions to instruct a device (which may be a single-chip microcomputer, a microcircuit, etc.) or a processor to execute all or some of the steps of the program. the methods described in the embodiments of this application.

[00449] The above description represents only specific implementations of this application, but it is not intended to limit the scope of protection of this application.

Any modification or substitution within the scope disclosed in this application will be within the scope of protection of this application. Therefore, the scope of protection of the present application should correspond to the scope of protection of the claims.

Claims (88)

1. A method for protecting a truncated parameter, wherein the method is characterized by the fact that it contains: determining by the mobility network element whether the terminal meets a predetermined condition; And sending by the mobility control network element to the terminal, when the terminal meets a predetermined condition, a downlink non-access layer (NAS) message in which NAS security protection is performed using the NAS security context, wherein the downlink NAS message contains a truncated parameter and a truncated parameter used to truncate the temporary identifier (5G-S-TMSI) of the mobile subscriber evolution of the 5th generation terminal system architecture. 2. The method of claim 1, wherein the truncated parameter is previously stored in the network mobility control element. 3. The method of claim 1, wherein the predetermined condition comprises that the terminal uses a system optimization (5GS) function of the 5th generation cellular Internet of things (CIoT) control plane, and the mobility management network element determining whether the terminal prequalifies given condition, contains: determining, through the mobility network element, whether the terminal uses a CIoT 5GS control plane optimization function; And determining, by the mobility network element, when the terminal uses the CIoT 5GS control plane optimization function, that the terminal meets a predetermined condition. 4. The method according to claim 1 or 2, wherein the preset condition further comprises that the terminal is initially registered in the network; And the determination by the mobility network element of whether the terminal meets a predetermined condition comprises: determining, through the mobility network element, whether the terminal uses a CIoT 5GS optimization function of the control plane and whether the terminal is initially registered with the network; And, if the terminal uses the CIoT 5GS control plane optimization function and the terminal is initially registered in the network, determining by the mobility network element that the terminal meets a predetermined condition; or, if the terminal does not use the CIoT 5GS control plane optimization function or the terminal is not initially registered with the network, determining by the mobility control network element that the terminal does not meet a predefined condition. 5. The method of claim 4, wherein determining by the network mobility element whether the terminal is initially registered with the network comprises determining by the mobility management network element, based on the registration type reported by the terminal, that the terminal is initially registered with the network. 6. The method as claimed in claim 1 or 2, wherein the preset condition comprises that the terminal is using a system optimization (5GS) function of the cellular Internet of Things (CIoT) 5th generation control plane and the terminal needs to update the truncated parameter; And the determination by the mobility network element of whether the terminal meets a predetermined condition comprises: determining, by the mobility network element, whether the terminal is using a CIoT 5GS control plane optimization function and whether the terminal needs to update the truncated parameter; And determining, by the mobility network element, when the terminal uses the CIoT 5GS control plane optimization function and the terminal needs to update the truncated parameter, that the terminal meets a predetermined condition. 7. The method of claim 6, wherein determining, by the mobility network element, whether the terminal needs to update the truncated parameter, comprises: when the truncated parameter configured in the mobility network element is different from the truncated parameter that is stored in the context of the terminal, determining by the mobility network element that the terminal needs to update the truncated parameter. 8. The method of claim 6, wherein determining, by the mobility network element, whether the terminal needs to update the truncated parameter, comprises: after the mobility network element updates the truncated parameter, determining by the mobility network element that the terminal needs to update the truncated parameter. 9. Method according to any one of paragraphs. 3-8, wherein the determination by the mobility network element of whether the terminal uses a CIoT 5GS control plane optimization function comprises: When the preferred network behavior reported by the terminal indicates that the terminal prefers to use the CIoT 5GS control plane optimization function, and the mobility control network element supports the CIoT 5GS control plane optimization function, determining by the mobility network element that the terminal uses the CIoT 5GS control plane optimization function management. 10. The method according to any one of paragraphs 1-9, additionally containing receiving, by the mobility network element, a registration request message from the terminal before determining whether the terminal meets a predetermined condition. 11. Method according to any one of paragraphs. 1-10, wherein the downlink NAS message is a service acceptance message or a registration acceptance message. 12. Method according to any one of paragraphs. 1-11, in which the first to tenth bits in 5G-S-TMSI are used to indicate the access and mobility management function (AMF) set ID, the eleventh to sixteenth bits in 5G-S-TMSI are used to indicate the AMF indicator, and bits c the seventeenth to forty-eighth in 5G-S-TMSI are used to indicate 5G-TMSI; And the truncated parameter contains a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI index. 13. A method for protecting a truncated parameter, characterized by the fact that it contains: receiving by the communication device from the mobility network element a downlink NAS message in which NAS security protection is performed using the NAS security context, wherein the downlink NAS message contains a truncated parameter and the truncated parameter is used to truncate the 5G-S-TMSI of the communication device; causing the communication device to remove security protection from the downlink NAS message; And storing the truncated parameter by the communication device after successfully performing security deprotection on the downlink NAS message. 14. The method of claim 13, wherein storing the truncated parameter by the communication device comprises storing the truncated parameter by the NAS layer of the communication device. 15. The method according to claim 14, wherein the method additionally contains: sending, by the NAS layer of the communication device, a truncated parameter to the radio resource control (RRC) layer of the communication device; And truncation by the RRC layer of the communication device 5G-S-TMSI of the communication device based on the truncated parameter to obtain a truncated 5G-S-TMSI. 16. The method according to claim 15, wherein the method additionally contains sending by the communication device an RRC re-establishment request message to the network access device, wherein the RRC re-establishment request message contains a truncated 5G-S-TMSI. 17. Method according to any one of paragraphs. 13-16, wherein the downlink NAS message is a service acceptance message or a registration acceptance message. 18. Method according to any one of paragraphs. 13-17, in which the first to tenth bits in 5G-S-TMSI are used to indicate the access and mobility management function (AMF) set ID, the eleventh to sixteenth bits in 5G-S-TMSI are used to indicate the AMF indicator, and bits c the seventeenth to forty-eighth in 5G-S-TMSI are used to indicate 5G-TMSI; And the truncated parameter contains a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI index. 19. Communication device, characterized in that it contains: at least one processor; And a memory coupled to the processor and containing program instructions stored in the memory that, when executed by the at least one processor, cause the communication device to: determining whether the terminal meets a predetermined condition; And sending to the terminal, when the terminal meets a predetermined condition, a downlink non-access layer (NAS) message in which NAS security protection is performed using the NAS security context, wherein the downlink NAS message contains a truncated parameter, and the truncated parameter is used for truncating temporary identifier (5G-S-TMSI) of the mobile subscriber of the evolution of the system architecture of the 5th generation terminal. 20. The communication device of claim 19, wherein the truncated parameter is previously stored in the network mobility control element. 21. The communication device of claim 19 or 20, wherein the predetermined condition comprises that the terminal uses a system optimization (5GS) function of the cellular Internet of Things (CIoT) 5th generation control plane and the software instructions further cause the communication device to: determining whether the terminal uses the CIoT 5GS control plane optimization function; And determining that the terminal meets a predetermined condition when the terminal uses the CIoT 5GS control plane optimization function. 22. The communication device of claim 19 or 20, wherein the predetermined condition comprises that the terminal is using a system optimization (5GS) function of the cellular Internet of things (CIoT) 5th generation control plane and the terminal needs to update the truncated parameter, and software instructions additionally instruct the communication device to: determining whether the terminal uses the CIoT 5GS control plane optimization function and whether the terminal needs to update the truncated parameter; And determining that the terminal meets a predetermined condition when the terminal uses the CIoT 5GS control plane optimization function and the terminal needs to update the truncated parameter. 23. The communication device of claim 22, wherein determining whether the terminal needs to update the truncated parameter comprises: when the truncated parameter configured in the mobility network element differs from the truncated parameter that is stored in the context of the terminal, determining that the terminal needs to update the truncated parameter. 24. The communication device of claim 21 or 22, wherein the software instructions further cause the communication device to determine that the terminal is using a CIoT 5GS control plane optimization function when the preferred network behavior reported by the terminal indicates that the terminal prefers to use the function CIoT 5GS control plane optimization and the communication device supports the CIoT 5GS control plane optimization function. 25. Communication device according to any one of paragraphs. 19-24, wherein the software instructions further cause the communication device to receive a registration request message from the terminal before determining whether the terminal meets a predetermined condition. 26. Communication device according to any one of paragraphs. 19-25, wherein the downlink NAS message is a service acceptance message or a registration acceptance message. 27. Communication device according to any one of paragraphs. 19-26, in which the first to tenth bits in 5G-S-TMSI are used to indicate the access and mobility management function (AMF) set ID, the eleventh to sixteenth bits in 5G-S-TMSI are used to indicate the AMF indicator, and bits c the seventeenth to forty-eighth in 5G-S-TMSI are used to indicate 5G-TMSI; And the truncated parameter contains a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI index. 28. A communication device characterized by the fact that it contains: at least one processor; And a memory coupled to the processor and containing program instructions stored in the memory that, when executed by the at least one processor, cause the communication device to: receiving from the mobility network element a downlink NAS message in which NAS security protection is performed using the NAS security context, wherein the downlink NAS message contains a truncated parameter and the truncated parameter is used to truncate the 5G-S-TMSI of the communication device; performing security deprotection on the downlink NAS message; And saving the truncated parameter after successful deprotection of the downlink NAS message. 29. The communication device of claim 28, wherein the software instructions further cause the communication device to store, through the NAS layer of the communication device, the truncated parameter. 30. The communication device according to claim 29, in which the software instructions additionally instruct the communication device to: sending, through the NAS layer of the communication device, a truncated parameter to the radio resource control (RRC) layer of the terminal; And truncation by the RRC layer of the communication device 5G-S-TMSI of the communication device based on the truncated parameter to obtain a truncated 5G-S-TMSI. 31. The communication device of claim 30, wherein the software instructions further cause the communication device to: send an RRC re-establishment request message to the network access device, wherein the RRC re-establishment request message contains a truncated 5G-S-TMSI. 32. Communication device according to any one of paragraphs. 28, 29, wherein the downlink NAS message is a service acceptance message or a registration acceptance message. 33. Communication device according to any one of paragraphs. 28, 29, in which the first to tenth bits in 5G-S-TMSI are used to indicate the access and mobility management function (AMF) set ID, the eleventh to sixteenth bits in 5G-S-TMSI are used to indicate the AMF indicator, and bits c the seventeenth to forty-eighth in 5G-S-TMSI are used to indicate 5G-TMSI; And the truncated parameter contains a first truncated parameter and a second truncated parameter, the first truncated parameter is used to truncate the AMF and 5G-TMSI set ID, and the second truncated parameter is used to truncate the AMF and 5G-TMSI index. 34. A computer-readable storage medium, wherein the computer-readable storage medium stores an instruction and, when the instruction is executed on a computer, the computer may perform the truncated parameter protecting method of any one of claims. 1-12. 35. A computer-readable storage medium, wherein the computer-readable storage medium stores an instruction and, when the instruction is executed on a computer, the computer may perform the truncation parameter protecting method of any one of claims. 13-18. 36. A microcircuit containing a processor, wherein when the processor executes an instruction of a computer program, the microcircuit is able to perform the method of protecting a truncated parameter according to any one of claims. 1-12. 37. A microcircuit containing a processor, wherein when the processor executes an instruction of a computer program, the microcircuit is able to perform the method of protecting the truncation parameter according to any one of claims. 13-18. 38. A method for protecting a truncated parameter, wherein the method is applicable to a communication system that includes a network mobility control element and a terminal, wherein the method comprises: determining by the mobility network element whether the terminal meets a predetermined condition; when the terminal meets a predetermined condition, the mobility management network element sending to the terminal a non-downlink access layer (NAS) message in which NAS security protection is performed using the NAS security context, wherein the downlink NAS message contains a truncated parameter, and the truncated parameter is used to truncate a temporary identifier (5G-S-TMSI) of the mobile subscriber of the 5th generation system architecture evolution of the terminal; the terminal performing security deprotection on the downlink NAS message; And storing the truncated parameter by the terminal after successfully deprotecting the downlink NAS message. 39. Communication system containing communication device according to any one of claims. 19-27 and a communication device according to any one of paragraphs. 28-33.

Images